[ceph-users] minimal permission set for an rbd client