Ceph » rbd

$ ceph auth get-or-create client.ceph-csi mon 'profile rbd' osd 'profile rbd' >> keyring 
$ ceph auth get client.ceph-csi
exported keyring for client.ceph-csi
[client.ceph-csi]
    key = AQCtJJ9d/g6vCxAAQ5r5Rbvxo5vo43wAGHGwkw==
    caps mon = "profile rbd" 
    caps osd = "profile rbd" 
$ rbd --id ceph-csi create --size 1G image
$ ceph --id ceph-csi rbd task add remove rbd/image
Error EACCES: access denied: does your client key have mgr caps? See http://docs.ceph.com/docs/master/mgr/administrator/#client-authentication
$ ceph auth caps client.ceph-csi mon 'profile rbd' osd 'profile rbd' mgr "allow command 'rbd task add remove'" 
$ ceph --id ceph-csi rbd task add remove rbd/image
{"sequence": 1, "id": "987a711e-e19a-476c-b64d-b98a0ddfa427", "message": "Removing image rbd/image", "refs": {"action": "remove", "pool_name": "rbd", "pool_namespace": "", "image_name": "image", "image_id": "10291e504559"}}

Create a new "mgr 'profile rbd [pool=XYZ]" cap to support these new commands. This also applies to the "rbd perf" commands.