Hi, Eugen Block via ceph-users <ceph-users@ceph.io> writes:

I haven't tried it myself yet so I don't really have an answer. But I noticed that your OSD caps may be incomplete wrt x permissions:

...

osd_caps: 'allow rwx namespace=k8s-test tag cephfs metadata=root, allow rw namespace=k8s-test tag cephfs data=root'

The second allow statement doesn't have an "x". Maybe that's the issue why the workaround fails?

We tried that, but the error remains. We now consider to use the following capabilities in combination to creating a dedicated data pool for each tenant (K8s cluster): mon_caps: 'allow r fsname=root' mgr_caps: 'allow rw' osd_caps: 'allow rwx pool=cephfs.meta, allow rw pool=cephfs.data, allow rw pool=cephfs.k8s-test' mds_caps: 'allow r fsname=root path=/volumes, allow rws fsname=root path=/volumes/k8s-test' CephFS is created with cephfs.meta as metadata pool and cephfs.data as default data pool while cephfs.k8s-test is the pool for this tenant. What are the implications to share the metadata/default data pools and have no namespace? Is the MDS capability sufficient to separate tenants or can everyone access the metadata objects of everyone else? -- Stefan