[Bug 1424771] Fix merged to charm-cinder (master)

[OpenStack Infra]

Reviewed:  https://review.openstack.org/432479
Committed: https://git.openstack.org/cgit/openstack/charm-cinder/commit/?id=d679c667767039ab7c3bc1fd5346b7c2a65bbf56
Submitter: Jenkins
Branch:    master

commit d679c667767039ab7c3bc1fd5346b7c2a65bbf56
Author: Chris MacNaughton <chmacnaughton at gmail.com>
Date:   Fri Feb 10 17:04:37 2017 -0500

    Add support for cephx pool grouping and permissions
    
    Sync charmhelpers and add configuration option to allow access
    to ceph pools to be limited based on grouping.
    
    Cinder requires rwx access to pools associated with volumes,
    images and vms (to support rbd snapshots).
    
    Change-Id: If1734c430108e193df0a58dc4c06ebe2b79990e3
    Partial-Bug: 1424771

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to cinder in Juju Charms Collection.
Matching subscriptions: charm-bugs
https://bugs.launchpad.net/bugs/1424771

Title:
  Excessive caps for CephX users glance, cinder, nova-compute

Status in charms.openstack:
  In Progress
Status in ceph package in Juju Charms Collection:
  In Progress
Status in ceph-mon package in Juju Charms Collection:
  In Progress
Status in ceph-radosgw package in Juju Charms Collection:
  Fix Committed
Status in cinder package in Juju Charms Collection:
  Fix Committed
Status in cinder-ceph package in Juju Charms Collection:
  Fix Committed
Status in glance package in Juju Charms Collection:
  Fix Committed
Status in nova-compute package in Juju Charms Collection:
  Fix Committed

Bug description:
  The cephx identities, which the charms generate for glance, cinder and
  nova-compute, have excessive capabilities. They allow write access to
  mons, and unrestricted access to OSDs.

  The following caps should be sufficient:

  For client.glance:
  mon = "allow r"
  osd = "allow rw pool=glance"

  For client.cinder:
  mon = "allow r"
  osd = "allow rw pool=cinder"

  For client.nova-compute:
  mon = "allow r"
  osd = "allow rwx pool=cinder"

To manage notifications about this bug go to:
https://bugs.launchpad.net/charms.openstack/+bug/1424771/+subscriptions