diff --git a/.github/workflows/canary-integration-test.yml b/.github/workflows/canary-integration-test.yml index 9aa1c7d30..cc90a25a9 100644 --- a/.github/workflows/canary-integration-test.yml +++ b/.github/workflows/canary-integration-test.yml @@ -57,20 +57,28 @@ jobs: kubectl -n rook-ceph exec $toolbox -- mkdir -p /etc/ceph/test-data kubectl -n rook-ceph cp tests/ceph-status-out $toolbox:/etc/ceph/test-data/ kubectl -n rook-ceph cp deploy/examples/create-external-cluster-resources.py $toolbox:/etc/ceph - # remove the existing client auth that will be re-created by external script - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-cephfs-node - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-cephfs-provisioner - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-rbd-node - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-rbd-provisioner + timeout 10 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool; do echo 'waiting for script to succeed' && sleep 1; done" # print existing client auth kubectl -n rook-ceph exec $toolbox -- ceph auth ls - timeout 10 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool; do echo 'waiting for script to succeed' && sleep 1; done" - name: dry run external script create-external-cluster-resources.py run: | toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name=replicapool --dry-run + - name: test external script create-external-cluster-resources.py if users already exist with different caps + run: | + toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') + # update client.csi-rbd-provisioner csi user caps + # print client.csi-rbd-provisioner user before update + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + kubectl -n rook-ceph exec $toolbox -- ceph auth caps client.csi-rbd-provisioner mon 'profile rbd, allow command "osd ls"' osd 'profile rbd' mgr 'allow rw' + # print client.csi-rbd-provisioner user after update + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool + # print client.csi-rbd-provisioner user after running script + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + - name: run external script create-external-cluster-resources.py unit tests run: | kubectl -n rook-ceph exec $(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[0].metadata.name}') -- python3 -m unittest /etc/ceph/create-external-cluster-resources.py diff --git a/deploy/examples/create-external-cluster-resources.py b/deploy/examples/create-external-cluster-resources.py index 44a8e78d9..218aeba79 100644 --- a/deploy/examples/create-external-cluster-resources.py +++ b/deploy/examples/create-external-cluster-resources.py @@ -103,6 +103,12 @@ class DummyRados(object): self.cmd_output_map['''{"format": "json", "prefix": "mgr services"}'''] = '''{"dashboard": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:7000/", "prometheus": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:9283/"}''' self.cmd_output_map['''{"entity": "client.healthchecker", "format": "json", "prefix": "auth get"}'''] = '''{"dashboard": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:7000/", "prometheus": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:9283/"}''' self.cmd_output_map['''{"entity": "client.healthchecker", "format": "json", "prefix": "auth get"}'''] = '''[{"entity":"client.healthchecker","key":"AQDFkbNeft5bFRAATndLNUSEKruozxiZi3lrdA==","caps":{"mon": "allow r, allow command quorum_status, allow command version", "mgr": "allow command config", "osd": "allow rwx pool=default.rgw.meta, allow r pool=.rgw.root, allow rw pool=default.rgw.control, allow rx pool=default.rgw.log, allow x pool=default.rgw.buckets.index"}}]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-node", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-rbd-node", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-rbd-provisioner", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner-openshift-storage", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner-openshift-storage-myfs", "format": "json", "prefix": "auth get"}'''] = '''[]''' self.cmd_output_map[self.cmd_names['caps_change_default_pool_prefix']] = '''[{}]''' self.cmd_output_map['{"format": "json", "prefix": "status"}'] = ceph_status_str @@ -509,6 +515,14 @@ class RadosJSON: all_mgr_ips_str = ",".join(mgr_ips) return all_mgr_ips_str, monitoring_endpoint_port + def check_user_exist(self,user): + cmd_json = {"prefix": "auth get", "entity": "{}".format( + user), "format": "json"} + ret_val, json_out, _ = self._common_cmd_json_gen(cmd_json) + if ret_val != 0 or len(json_out) == 0: + return "" + return str(json_out[0]['key']) + def create_cephCSIKeyring_cephFSProvisioner(self): ''' command: ceph auth get-or-create client.csi-cephfs-provisioner mon 'allow r' mgr 'allow rw' osd 'allow rw tag cephfs metadata=*' @@ -546,6 +560,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -592,6 +611,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -626,6 +650,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -747,6 +776,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: