Merge lp:~james-page/charms/precise/ceph/fixup-mon-perms into lp:~charmers/charms/precise/ceph/trunk

[James Page]

Fixup mon permissions for client and radosgw so pools can be created still

[Edward Hope-Morley (hopem)]

This looks good. As discussed, one concern with increasing the mon permissions is that each client can now delete any pool. Since we can infer the name of the pool the client is creating, it would be nice/safer to restrict the mon operations to a the client's pool but ceph does not appear to allow restricting mon operations to a single pool (like with 'osd allow rw pool=foo'). Lets go ahead with this patch and make sure we follow up with a patch to allow new clients to have their pools created by the ceph charm thus allowing for the rw perm to be removed (which should not break compatibility since the client does not attempt to create the pool if it already exists).

[Adam Gandelman (gandelman-a)]

This addresses all of my concerns from last weeks. Thanks.

review: Approve

=== modified file 'hooks/ceph.py'
--- hooks/ceph.py	2013-08-27 13:57:46 +0000
+++ hooks/ceph.py	2013-09-23 10:31:33 +0000
@@ -224,7 +224,7 @@
 
 # OSD caps taken from ceph-create-keys
 _radosgw_caps = {
-    'mon': ['allow r'],
+    'mon': ['allow rw'],
     'osd': ['allow rwx']
 }
 
@@ -234,7 +234,7 @@
 
 
 _default_caps = {
-    'mon': ['allow r'],
+    'mon': ['allow rw'],
     'osd': ['allow rwx']
 }
 
@@ -259,6 +259,19 @@
     return parse_key(subprocess.check_output(cmd).strip())  # IGNORE:E1103
 
 
+def upgrade_key_caps(key, caps):
+    ''' Upgrade key to have capabilities caps '''
+    if not is_leader():
+        # Not the MON leader OR not clustered
+        return
+    cmd = [
+        'ceph', 'auth', 'caps', key
+    ]
+    for subsystem, subcaps in caps.iteritems():
+        cmd.extend([subsystem, '; '.join(subcaps)])
+    subprocess.check_call(cmd)
+
+
 def bootstrap_monitor_cluster(secret):
     hostname = get_unit_hostname()
     path = '/var/lib/ceph/mon/ceph-{}'.format(hostname)

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2013-08-27 11:47:16 +0000
+++ hooks/hooks.py	2013-09-23 10:31:33 +0000
@@ -206,6 +206,19 @@
     log('End notify_client.')
 
 
+def upgrade_keys():
+    ''' Ceph now required mon allow rw for pool creation '''
+    if len(relation_ids('radosgw')) > 0:
+        ceph.upgrade_key_caps('client.radosgw.gateway',
+                              ceph._radosgw_caps)
+    for relid in relation_ids('client'):
+        units = related_units(relid)
+        if len(units) > 0:
+            service_name = units[0].split('/')[0]
+            ceph.upgrade_key_caps('client.{}'.format(service_name),
+                                  ceph._default_caps)
+
+
 @hooks.hook('osd-relation-joined')
 def osd_relation():
     log('Begin osd-relation hook.')
@@ -259,6 +272,7 @@
     apt_install(packages=filter_installed_packages(ceph.PACKAGES), fatal=True)
     install_upstart_scripts()
     ceph.update_monfs()
+    upgrade_keys()
     log('End upgrade-charm hook.')