Does radosgw really need to talk to an MDS?

Does radosgw really need to talk to an MDS?

[Florian Haas]

Hi everyone,

radosgw(8) states that the following capabilities must be granted to
the user that radosgw uses to connect to RADOS.

ceph-authtool -n client.radosgw.gateway --cap mon 'allow r' --cap osd
'allow rwx' --cap mds 'allow' /etc/ceph/keyring.radosgw.gateway

Could someone explain why we need an "mds 'allow'" in here? I thought
only CephFS clients talked to MDSs, and at first glance configuring
client.radosgw.gateway without any MDS capability seems not to break
anything (at least with my limited S3 tests). Am I missing something?

Cheers,
Florian

Re: Does radosgw really need to talk to an MDS?

[Wido den Hollander]

Hi,

On 02-07-12 13:41, Florian Haas wrote:
> Hi everyone,
>
> radosgw(8) states that the following capabilities must be granted to
> the user that radosgw uses to connect to RADOS.
>
> ceph-authtool -n client.radosgw.gateway --cap mon 'allow r' --cap osd
> 'allow rwx' --cap mds 'allow' /etc/ceph/keyring.radosgw.gateway
>
> Could someone explain why we need an "mds 'allow'" in here? I thought
> only CephFS clients talked to MDSs, and at first glance configuring
> client.radosgw.gateway without any MDS capability seems not to break
> anything (at least with my limited S3 tests). Am I missing something?
>

You are not allowing the RADOS Gateway to do anything on the MDS.

There is no 'r',  'w' or 'x' permission which you are allowing. So there 
is nothing the rgw has access to on the MDS.

Wido

> Cheers,
> Florian
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: Does radosgw really need to talk to an MDS?

[Florian Haas]

On Mon, Jul 2, 2012 at 1:44 PM, Wido den Hollander <wido@widodh.nl> wrote:
> You are not allowing the RADOS Gateway to do anything on the MDS.
>
> There is no 'r',  'w' or 'x' permission which you are allowing. So there is
> nothing the rgw has access to on the MDS.

Yep, so we might as well leave off "--cap mds 'allow'"?

Florian

Re: Does radosgw really need to talk to an MDS?

[Wido den Hollander]

On 02-07-12 13:56, Florian Haas wrote:
> On Mon, Jul 2, 2012 at 1:44 PM, Wido den Hollander <wido@widodh.nl> wrote:
>> You are not allowing the RADOS Gateway to do anything on the MDS.
>>
>> There is no 'r',  'w' or 'x' permission which you are allowing. So there is
>> nothing the rgw has access to on the MDS.
>
> Yep, so we might as well leave off "--cap mds 'allow'"?

I think so. You can always give it a try.

The RGW doesn't talk to the MDS anyway, so probably nothing will break.

Wido

>
> Florian
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: Does radosgw really need to talk to an MDS?

[Sage Weil]

On Mon, 2 Jul 2012, Wido den Hollander wrote:
> On 02-07-12 13:56, Florian Haas wrote:
> > On Mon, Jul 2, 2012 at 1:44 PM, Wido den Hollander <wido@widodh.nl> wrote:
> > > You are not allowing the RADOS Gateway to do anything on the MDS.
> > > 
> > > There is no 'r',  'w' or 'x' permission which you are allowing. So there
> > > is
> > > nothing the rgw has access to on the MDS.
> > 
> > Yep, so we might as well leave off "--cap mds 'allow'"?
> 
> I think so. You can always give it a try.
> 
> The RGW doesn't talk to the MDS anyway, so probably nothing will break.

Yep, that's an error in the documentation!  The mds cap should be left 
off.

sage

Re: Does radosgw really need to talk to an MDS?

[Gregory Farnum]

On Mon, Jul 2, 2012 at 4:44 AM, Wido den Hollander <wido@widodh.nl> wrote:
> Hi,
>
>
> On 02-07-12 13:41, Florian Haas wrote:
>>
>> Hi everyone,
>>
>> radosgw(8) states that the following capabilities must be granted to
>> the user that radosgw uses to connect to RADOS.
>>
>> ceph-authtool -n client.radosgw.gateway --cap mon 'allow r' --cap osd
>> 'allow rwx' --cap mds 'allow' /etc/ceph/keyring.radosgw.gateway
>>
>> Could someone explain why we need an "mds 'allow'" in here? I thought
>> only CephFS clients talked to MDSs, and at first glance configuring
>> client.radosgw.gateway without any MDS capability seems not to break
>> anything (at least with my limited S3 tests). Am I missing something?
>>
>
> You are not allowing the RADOS Gateway to do anything on the MDS.
>
> There is no 'r',  'w' or 'x' permission which you are allowing. So there is
> nothing the rgw has access to on the MDS.

Actually, that is an MDS cap — it's the "allow" cap, and that's all
that the MDS checks right now. But it is indeed completely unnecessary
for the MDS. (Thanks for the doc fix, Florian!)
-Greg
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html