From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: Re: [pve-devel] [PATCH master ceph, quincy-stable-8 ceph, pve-storage, pve-manager 0/8] Fix #4759: Configure Permissions for ceph-crash.service
Date: Wed, 31 Jan 2024 14:25:04 +0100 [thread overview]
Message-ID: <1706707145.wnmi8cojjo.astroid@yuna.none> (raw)
In-Reply-To: <20240130184041.1125674-1-m.carrara@proxmox.com>
On January 30, 2024 7:40 pm, Max Carrara wrote:
> Introduction
> ------------
>
> This series fixes #4759 [0], an issue where Ceph's crash daemon is
> unable to post crash logs due to insufficient permissions, through an
> adaptation of our `pveceph` CLI as well as an accompanying Debian
> postinst hook.
>
> In essence, this series ensures that the crash daemon can authenticate
> with its Ceph cluster without requiring elevated privileges.
>
> For this to work, the following conditions required:
> 1. A key named 'client.crash' must be stored in the Ceph cluster
> itself
> 2. The key must be saved to a '.keyring' file which can be read by
> the `ceph` user (in order to authenticate with the cluster)
> 3. A reference to the '.keyring' file's location must be provided in
> a 'client.crash' section within the '/etc/pve/ceph.conf' file
I like the general direction, it seems sensible. some comments on
individual patches as replies, and some general questions here:
- do we need to store the key on pmxcfs? would it also work to generate
one on each host and store it locally?
- is there some way to get away without modifying the config? e.g., a
fallback path for keyrings if there is no "client.XXX" section in the
config?
https://docs.ceph.com/en/reef/rados/configuration/auth-config-ref/#keys
would seem to indicate that the answer to those questions is
no/yes/yes, but I haven't tested it ;)
IMHO that would simplify the handling a lot..
next prev parent reply other threads:[~2024-01-31 13:25 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-30 18:40 Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH master ceph 1/8] debian: add patch to fix ceph crash dir permissions in postinst hook Max Carrara
2024-01-31 13:18 ` Fabian Grünbichler
2024-02-01 13:28 ` Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH quincy-stable-8 ceph 2/8] " Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH pve-storage 3/8] cephconfig: support sections in the format of [client.$NAME] Max Carrara
2024-01-31 13:18 ` Fabian Grünbichler
2024-02-01 13:40 ` Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH pve-manager 4/8] ceph: fix edge case of wrong files being deleted on purge Max Carrara
2024-01-31 13:18 ` Fabian Grünbichler
2024-02-01 13:59 ` Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH pve-manager 5/8] fix #4759: ceph: configure keyring for ceph-crash.service Max Carrara
2024-01-31 13:17 ` Fabian Grünbichler
2024-02-05 11:57 ` Max Carrara
2024-02-12 13:41 ` Fabian Grünbichler
2024-01-30 18:40 ` [pve-devel] [PATCH pve-manager 6/8] ceph: create '/etc/pve/ceph' during `pveceph init` Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH pve-manager 7/8] debian/postinst: fix shellcheck warning Max Carrara
2024-01-31 13:16 ` [pve-devel] applied-partially: " Fabian Grünbichler
2024-02-01 13:40 ` Max Carrara
2024-01-30 18:40 ` [pve-devel] [PATCH pve-manager 8/8] fix #4759: debian/postinst: configure ceph-crash.service and its key Max Carrara
2024-01-31 13:15 ` Fabian Grünbichler
2024-02-01 13:54 ` Max Carrara
2024-01-31 13:25 ` Fabian Grünbichler [this message]
2024-01-31 14:22 ` [pve-devel] [PATCH master ceph, quincy-stable-8 ceph, pve-storage, pve-manager 0/8] Fix #4759: Configure Permissions for ceph-crash.service Friedrich Weber
2024-02-01 13:35 ` Fabian Grünbichler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1706707145.wnmi8cojjo.astroid@yuna.none \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox