<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello everyone,</p>
<p>I'm currently testing manila with CephFS and I stumbled upon a
behavior where manila is able to overwrite existing Ceph users.<br>
In my testing setup glance, nova, cinder and manila share the same
Ceph cluster. However they have different users.<br>
In this situation when you create a share and allow acces via <span
class="go">"<tt>manila access-allow cephshare1 cephx test</tt>"<br>
If the user "<tt>test</tt>" is already used to access some pools
on the cluster, let's say cinder-volume or glance-images it will
be overwritten with the permissions for the share.<br>
Which will break any resources that was using it.<br>
<span class="go">I've recheck the configuration files multiple
times to see if I could set some properties to avoid this but
I didn't find any.<br>
</span>By quickly looking at the code here :
<a class="moz-txt-link-freetext" href="https://opendev.org/openstack/manila/src/branch/master/manila/share/drivers/cephfs/driver.py">https://opendev.org/openstack/manila/src/branch/master/manila/share/drivers/cephfs/driver.py</a><br>
A check is done but only for the manila user. I'm on Rocky
version but this part doesn't seems to have changed since.<br>
</span></p>
<p><span class="go">That lead me to some questions :<br>
- Does manila must have his own dedicated Ceph cluster ?<br>
- Is there any workaroud to this ? Other than putting some
gibberish names for services users ?<br>
- Is it possible to lock some users in the Ceph cluster to
prevent this behavior ?<br>
<br>
If someone has some clues on this, thanks in advance.<br>
Jahson.B<br>
<br>
</span></p>
</body>
</html>