Running cephadm as a nonroot user
We have been using ceph-deploy in our existing cluster running as a non root user with sudo permissions. I've been working on getting an octopus cluster working using cephadm. During bootstrap I ran into a "execnet.gateway_bootstrap.HostNotFound" issue. It turns out that the problem was caused by an sshd setting we use: "PermitRootLogin no". Since we do not allow root ssh login directly, is there a way to make cephadm use ssh as a nonroot user with sudo permissions like we did with ceph-deploy?
There is a 'packaged' mode that does this, but it's a bit different: - you have to install the cephadm package on each host - the package sets up a cephadm user and sudoers.d file - mgr/cephadm will ssh in as that user and sudo as needed The net is that you have to make sure cephadm is installed and up to date (vs the 'root' mode that does pipes the mgr's copy to teh remote python interpreter). On Mon, 10 Feb 2020, Jason Borden wrote:
We have been using ceph-deploy in our existing cluster running as a non root user with sudo permissions. I've been working on getting an octopus cluster working using cephadm. During bootstrap I ran into a "execnet.gateway_bootstrap.HostNotFound" issue. It turns out that the problem was caused by an sshd setting we use: "PermitRootLogin no". Since we do not allow root ssh login directly, is there a way to make cephadm use ssh as a nonroot user with sudo permissions like we did with ceph-deploy? _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Thanks for the quick reply! I am using the cephadm package. I just wasn't aware that of the user that was created as part of the package install. My /etc/sudoers.d/cephadm seems to be incorrect. It gives root permission to /usr/bin/cephadm, but cephadm is installed in /usr/sbin. That is easily fixed though. I added a "cephadm ALL=NOPASSWD: /usr/sbin/cephadm --image * bootstrap *", and ran "sudo /usr/sbin/cephadm --image ceph/daemon-base:latest-master-devel bootstrap --mon-ip 10.8.13.121" as the cephadm user, but still got the "execnet.gateway_bootstrap.HostNotFound" error. Is there documentation somewhere on how to bootstrap using the cephadm user?
Ok, I've been digging around a bit with the code and made progress, but haven't got it all working yet. Here's what I've done: # yum install cephadm # ln -s ../sbin/cephadm /usr/bin/cephadm #Needed to reference the correct path # cephadm bootstrap --output-config /etc/ceph/ceph.conf --output-keyring /etc/ceph/ceph.client.admin.keyring --skip-ssh --mon-ip 10.8.13.121 # ceph mgr module enable cephadm # ceph config set mgr mgr/cephadm/mode cephadm-package # ceph cephadm generate-key # ceph cephadm get-pub-key > ~cephadm/.ssh/authorized_keys # echo "cephadm ALL=NOPASSWD: /usr/bin/cephadm --image * check-host *" >> /etc/sudoers.d/cephadm #Needed to run check-host as part of joining other nodes At this point it seems to be configured to use the cephadm user. Distribute the public key to other hosts with cephadm package installed. However I am now getting errors when trying to add a host with orchestrator or when doing a host-check: # ceph orchestrator host add k8shost3.acedatacenter.com 10.8.13.123 Error EINVAL: Traceback (most recent call last): File "/usr/share/ceph/mgr/mgr_module.py", line 1069, in _handle_command return CLICommand.COMMANDS[cmd['prefix']].call(self, cmd, inbuf) File "/usr/share/ceph/mgr/mgr_module.py", line 309, in call return self.func(mgr, **kwargs) File "/usr/share/ceph/mgr/orchestrator.py", line 142, in wrapper return func(*args, **kwargs) File "/usr/share/ceph/mgr/orchestrator_cli/module.py", line 168, in _add_host orchestrator.raise_if_exception(completion) File "/usr/share/ceph/mgr/orchestrator.py", line 639, in raise_if_exception raise e orchestrator.OrchestratorError: New host k8shost3.acedatacenter.com (10.8.13.123) failed check: ['usage: cephadm [-h] [--image IMAGE] [--docker] [--data-dir DATA_DIR]', ' [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]', ' [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]', ' {version,pull,ls,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,bootstrap,deploy,check-host}', ' ...', 'cephadm: error: unrecognized arguments: --expect-hostname k8shost3.acedatacenter.com'] Again, I'm not sure I've done everything that I need to get things set up. Any thoughts?
I missed a line while pasting the previous message: # ceph orchestrator set backend cephadm
participants (2)
-
Jason Borden
-
Sage Weil