Project

General

Profile

Actions
Copy link

Bug #48925

closed

cephadm: iscsi missing mgr permissions

Added by Juan Miguel Olmo Martínez over 3 years ago. Updated over 2 years ago.

Status:
Resolved
Priority:
High
Assignee:
Juan Miguel Olmo Martínez
Category:
cephadm
Target version:
-
% Done:

0%

Source:
Development
Tags:
Backport:
octopus
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
38982
Crash signature (v1):
Crash signature (v2):

Description

Error after deploying iscsi daemons:

debug 2020-12-20T21:01:53.910+0000 7f76f932e700  0 log_channel(audit) log [INF] : from='client.104309 -' entity='client.iscsi.iscsi.maint-3.njwqhz' cmd=[{"prefix": "service status", "format": "json"}]:  access denied
debug 2020-12-20T21:01:53.910+0000 7f76f932e700 -1 mgr.server reply reply (13) Permission denied access denied: does your client key have mgr caps? See http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication

It is needed to change default permission to:

ceph auth caps <iscsi_daemon_client>  mon 'profile rbd, allow command "osd blocklist", allow command "config-key get" with "key" prefix "iscsi/"' mgr 'allow *' osd 'allow rwx'

Related issues 1 (0 open — 1 closed)

Related to Orchestrator - Bug #48107: cephadm fails to deploy iscsi gateway when selinux is enabledCan't reproduceJuan Miguel Olmo Martínez

Actions
Actions
Copy link
 #1

Updated by Sebastian Wagner over 3 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by Juan Miguel Olmo Martínez over 3 years ago

  • Status changed from New to Fix Under Review
  • Pull request ID set to 38982
Actions
Copy link
 #3

Updated by Sebastian Wagner about 3 years ago

  • Status changed from Fix Under Review to Resolved
Actions
Copy link
 #4

Updated by Sebastian Wagner about 3 years ago

  • Related to Bug #48107: cephadm fails to deploy iscsi gateway when selinux is enabled added
Actions
Copy link
 #5

Updated by Mykola Golub over 2 years ago

  • Status changed from Resolved to Pending Backport
  • Backport set to octopus
Actions
Copy link
 #7

Updated by Sebastian Wagner over 2 years ago

  • Status changed from Pending Backport to Resolved
Actions
Copy link
 #8

Updated by Yuri Weinstein over 2 years ago

Mykola Golub wrote:

octopus backport PR: https://github.com/ceph/ceph/pull/43822

merged

Actions
Copy link

Also available in: Atom PDF