Hi, that's exactly where we landed this week with our own 11 year old cluster. We tried to access a home directory on a fresh openSUSE Leap 16 system via CephFS and failed due to an old auth cap for that user. We did migrate a couple of rbd clients over the years to the "profile rbd" syntax. But we still have some leftovers, so this is gonna take some time. I usually create new clients and compare them (like you did), then take some uncritical client and update its caps. If nobody complains, I adapt it on other clients as well. But I'm not aware of any documented update strategy, and at the same time I expect backwards compatibility for such clients. Our specific issue was an "allow r path=/" statement which MDS rejects if the user is supposed to only have access to a subdirectory. It still works with 6.4 kernel but failed with kernel 6.12. Regards, Eugen Zitat von Jan Kasprzak via ceph-users <ceph-users@ceph.io>:
Hello, Ceph users,
is there a recommended way how to keep ceph users' capabilities up-to-date? I have a many years old cluster originally based on Hammer, gradually updated up to Tentacle, and I noticed that users created for rbd access long time ago according to recommendations of that time differ in their capabilities:
# ceph auth ls [...] client.one key: XXX...== caps: [mgr] allow r caps: [mon] allow r, allow command "osd blacklist" caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=one client.two key: YYY...== caps: [mgr] allow r caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=two client.three key: ZZZ...== caps: [mgr] profile rbd pool=three caps: [mon] profile rbd caps: [osd] profile rbd pool=three
are the above setting equivalent on Tentacle? Can the older users "client.one" and "client.two" be safely updated to the same settings as the "client.three"?
Thanks!
-Yenya
-- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | https://www.fi.muni.cz/~kas/ GPG: 4096R/A45477D5 | I don't like Python; its lack of inline, anonymous, multi-statement functions makes me sad. --Eric Wastl _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io