From 4f43f2d93e3da4b1e8a6d1dcb6318f64288b8bd2 Mon Sep 17 00:00:00 2001 From: parth-gr Date: Fri, 4 Feb 2022 17:56:05 +0530 Subject: [PATCH] csi: make create and get process separate for csi users Currently if we run external-script and user already exit, it fails to create/run same user again if the caps are upgraded, so we need to check first if user is already present. And for upgrading user we can do upgrade after this PR: https://github.com/rook/rook/pull/9609 will get merged. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2048458 Signed-off-by: parth-gr --- .github/workflows/canary-integration-test.yml | 20 +++++++---- .../create-external-cluster-resources.py | 34 +++++++++++++++++++ 2 files changed, 48 insertions(+), 6 deletions(-) diff --git a/.github/workflows/canary-integration-test.yml b/.github/workflows/canary-integration-test.yml index 9aa1c7d30..cc90a25a9 100644 --- a/.github/workflows/canary-integration-test.yml +++ b/.github/workflows/canary-integration-test.yml @@ -57,20 +57,28 @@ jobs: kubectl -n rook-ceph exec $toolbox -- mkdir -p /etc/ceph/test-data kubectl -n rook-ceph cp tests/ceph-status-out $toolbox:/etc/ceph/test-data/ kubectl -n rook-ceph cp deploy/examples/create-external-cluster-resources.py $toolbox:/etc/ceph - # remove the existing client auth that will be re-created by external script - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-cephfs-node - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-cephfs-provisioner - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-rbd-node - kubectl -n rook-ceph exec $toolbox -- ceph auth del client.csi-rbd-provisioner + timeout 10 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool; do echo 'waiting for script to succeed' && sleep 1; done" # print existing client auth kubectl -n rook-ceph exec $toolbox -- ceph auth ls - timeout 10 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool; do echo 'waiting for script to succeed' && sleep 1; done" - name: dry run external script create-external-cluster-resources.py run: | toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name=replicapool --dry-run + - name: test external script create-external-cluster-resources.py if users already exist with different caps + run: | + toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') + # update client.csi-rbd-provisioner csi user caps + # print client.csi-rbd-provisioner user before update + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + kubectl -n rook-ceph exec $toolbox -- ceph auth caps client.csi-rbd-provisioner mon 'profile rbd, allow command "osd ls"' osd 'profile rbd' mgr 'allow rw' + # print client.csi-rbd-provisioner user after update + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool + # print client.csi-rbd-provisioner user after running script + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-provisioner + - name: run external script create-external-cluster-resources.py unit tests run: | kubectl -n rook-ceph exec $(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[0].metadata.name}') -- python3 -m unittest /etc/ceph/create-external-cluster-resources.py diff --git a/deploy/examples/create-external-cluster-resources.py b/deploy/examples/create-external-cluster-resources.py index 44a8e78d9..218aeba79 100644 --- a/deploy/examples/create-external-cluster-resources.py +++ b/deploy/examples/create-external-cluster-resources.py @@ -103,6 +103,12 @@ class DummyRados(object): self.cmd_output_map['''{"format": "json", "prefix": "mgr services"}'''] = '''{"dashboard": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:7000/", "prometheus": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:9283/"}''' self.cmd_output_map['''{"entity": "client.healthchecker", "format": "json", "prefix": "auth get"}'''] = '''{"dashboard": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:7000/", "prometheus": "http://rook-ceph-mgr-a-57cf9f84bc-f4jnl:9283/"}''' self.cmd_output_map['''{"entity": "client.healthchecker", "format": "json", "prefix": "auth get"}'''] = '''[{"entity":"client.healthchecker","key":"AQDFkbNeft5bFRAATndLNUSEKruozxiZi3lrdA==","caps":{"mon": "allow r, allow command quorum_status, allow command version", "mgr": "allow command config", "osd": "allow rwx pool=default.rgw.meta, allow r pool=.rgw.root, allow rw pool=default.rgw.control, allow rx pool=default.rgw.log, allow x pool=default.rgw.buckets.index"}}]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-node", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-rbd-node", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-rbd-provisioner", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner-openshift-storage", "format": "json", "prefix": "auth get"}'''] = '''[]''' + self.cmd_output_map['''{"entity": "client.csi-cephfs-provisioner-openshift-storage-myfs", "format": "json", "prefix": "auth get"}'''] = '''[]''' self.cmd_output_map[self.cmd_names['caps_change_default_pool_prefix']] = '''[{}]''' self.cmd_output_map['{"format": "json", "prefix": "status"}'] = ceph_status_str @@ -509,6 +515,14 @@ class RadosJSON: all_mgr_ips_str = ",".join(mgr_ips) return all_mgr_ips_str, monitoring_endpoint_port + def check_user_exist(self,user): + cmd_json = {"prefix": "auth get", "entity": "{}".format( + user), "format": "json"} + ret_val, json_out, _ = self._common_cmd_json_gen(cmd_json) + if ret_val != 0 or len(json_out) == 0: + return "" + return str(json_out[0]['key']) + def create_cephCSIKeyring_cephFSProvisioner(self): ''' command: ceph auth get-or-create client.csi-cephfs-provisioner mon 'allow r' mgr 'allow rw' osd 'allow rw tag cephfs metadata=*' @@ -546,6 +560,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -592,6 +611,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -626,6 +650,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: @@ -747,6 +776,11 @@ class RadosJSON: "format": "json"} if self._arg_parser.dry_run: return self.dry_run("ceph " + cmd_json['prefix'] + " " + cmd_json['entity'] + " " + " ".join(cmd_json['caps'])) + # check if user already exist + user_key = self.check_user_exist(entity) + if user_key != "": + return user_key + ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, if ret_val != 0 or len(json_out) == 0: