mgr: use the ac-user-set-password cmd to update the password

previous code was calling the following command to create the
dashboard user:
> ceph dashboard ac-user-create <username> -i <password-file>
this works the first time when the user doesn't exist, however subsequent
calls for example when the password has changed or when the secret was
deleted from k8s, will not take place as this command will succeeded
because the user already exists but the password is not updated in
this case. The fix consists in adding an explicit call to the command:
> ceph dashboard ac-user-set-password <username> -i <password-file>
which ensures the password is updated correctly in the access control db

Fixes: https://github.com/rook/rook/issues/13594

Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit cb028f3a28)
This commit is contained in:
Redouane Kachach authored and Mergify committed 2024-01-31 15:48:00 +00:00
1 parent 1635d10635
commit 64e01267c6
1 file changed
+21 -3
+21 -3
View File
@@ -270,19 +270,37 @@ func (c *Cluster) setLoginCredentials(password string) error {
if err != nil {
return errors.Wrap(err, "failed to create a temporary dashboard password file")
}
args = []string{"dashboard", "ac-user-create", dashboardUsername, "-i", file.Name(), "administrator"}
defer func() {
if err := os.Remove(file.Name()); err != nil {
logger.Errorf("failed to clean up dashboard password file %q. %v", file.Name(), err)
}
}()
// Create dashboard user
// > ceph dashboard ac-user-create <username> -i <path-to-password-file>
//
// Note: this command will succeed in case the user <dashboardUsername> already
// exists however it will not update the password. That why we need to explicitly
// call the ac-user-set-password command to ensure the password is updated correctly
args = []string{"dashboard", "ac-user-create", dashboardUsername, "-i", file.Name(), "administrator"}
_, err = client.ExecuteCephCommandWithRetry(func() (string, []byte, error) {
output, err := client.NewCephCommand(c.context, c.clusterInfo, args).RunWithTimeout(exec.CephCommandsTimeout)
return "set dashboard creds", output, err
return "create dashboard user", output, err
}, 5, dashboardInitWaitTime)
if err != nil {
return errors.Wrap(err, "failed to set login creds on mgr")
return errors.Wrapf(err, "failed to create dashboard user %q", dashboardUsername)
}
// Set dashboard user password
// > ceph dashboard ac-user-set-password <username> -i <path-to-password-file>
args = []string{"dashboard", "ac-user-set-password", dashboardUsername, "-i", file.Name()}
_, err = client.ExecuteCephCommandWithRetry(func() (string, []byte, error) {
output, err := client.NewCephCommand(c.context, c.clusterInfo, args).RunWithTimeout(exec.CephCommandsTimeout)
return "set dashboard user password", output, err
}, 5, dashboardInitWaitTime)
if err != nil {
return errors.Wrapf(err, "failed to set password for user %q", dashboardUsername)
}
logger.Info("successfully set ceph dashboard creds")