From 64e01267c62c74ada1fc53e4e8367a783aaba154 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@redhat.com>
Date: Tue, 30 Jan 2024 14:20:27 +0100
Subject: [PATCH] mgr: use the ac-user-set-password cmd to update the password

previous code was calling the following command to create the
dashboard user:
> ceph dashboard ac-user-create <username> -i <password-file>
this works the first time when the user doesn't exist, however subsequent
calls for example when the password has changed or when the secret was
deleted from k8s, will not take place as this command will succeeded
because the user already exists but the password is not updated in
this case. The fix consists in adding an explicit call to the command:
> ceph dashboard ac-user-set-password <username> -i <password-file>
which ensures the password is updated correctly in the access control db

Fixes: https://github.com/rook/rook/issues/13594

Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit cb028f3a28370c5011ae82d3f11f1ee1f9607202)
---
 pkg/operator/ceph/cluster/mgr/dashboard.go | 24 +++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/pkg/operator/ceph/cluster/mgr/dashboard.go b/pkg/operator/ceph/cluster/mgr/dashboard.go
index a5c90120c..2b79f1382 100644
--- a/pkg/operator/ceph/cluster/mgr/dashboard.go
+++ b/pkg/operator/ceph/cluster/mgr/dashboard.go
@@ -270,19 +270,37 @@ func (c *Cluster) setLoginCredentials(password string) error {
 	if err != nil {
 		return errors.Wrap(err, "failed to create a temporary dashboard password file")
 	}
-	args = []string{"dashboard", "ac-user-create", dashboardUsername, "-i", file.Name(), "administrator"}
+
 	defer func() {
 		if err := os.Remove(file.Name()); err != nil {
 			logger.Errorf("failed to clean up dashboard password file %q. %v", file.Name(), err)
 		}
 	}()
 
+	// Create dashboard user
+	// > ceph dashboard ac-user-create <username> -i <path-to-password-file>
+	//
+	// Note: this command will succeed in case the user <dashboardUsername> already
+	// exists however it will not update the password. That why we need to explicitly
+	// call the ac-user-set-password command to ensure the password is updated correctly
+	args = []string{"dashboard", "ac-user-create", dashboardUsername, "-i", file.Name(), "administrator"}
 	_, err = client.ExecuteCephCommandWithRetry(func() (string, []byte, error) {
 		output, err := client.NewCephCommand(c.context, c.clusterInfo, args).RunWithTimeout(exec.CephCommandsTimeout)
-		return "set dashboard creds", output, err
+		return "create dashboard user", output, err
 	}, 5, dashboardInitWaitTime)
 	if err != nil {
-		return errors.Wrap(err, "failed to set login creds on mgr")
+		return errors.Wrapf(err, "failed to create dashboard user %q", dashboardUsername)
+	}
+
+	// Set dashboard user password
+	// > ceph dashboard ac-user-set-password <username> -i <path-to-password-file>
+	args = []string{"dashboard", "ac-user-set-password", dashboardUsername, "-i", file.Name()}
+	_, err = client.ExecuteCephCommandWithRetry(func() (string, []byte, error) {
+		output, err := client.NewCephCommand(c.context, c.clusterInfo, args).RunWithTimeout(exec.CephCommandsTimeout)
+		return "set dashboard user password", output, err
+	}, 5, dashboardInitWaitTime)
+	if err != nil {
+		return errors.Wrapf(err, "failed to set password for user %q", dashboardUsername)
 	}
 
 	logger.Info("successfully set ceph dashboard creds")