提示：从keyring文件导入用户需要用到-i选项来指定对应导入的keyring文件；
修改用户caps命令：ceph auth caps TYPE.ID daemon 'allow [r|w|x|*|...] [pool=pool-name] [namespace=namespace-name]' ...
[root@ceph-admin ~]# ceph auth get client.testexported keyring for client.test[client.test]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow *"caps mgr = "allow *"caps mon = "allow r"caps osd = "allow rw pool=rbdpool"[root@ceph-admin ~]# ceph auth caps client.test mds 'allow rw' mgr 'allow r' mon 'allow rw'updated caps for client.test[root@ceph-admin ~]# ceph auth get client.testexported keyring for client.test[client.test]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow rw"caps mgr = "allow r"caps mon = "allow rw"[root@ceph-admin ~]# ceph auth caps client.test mds 'allow rw' mgr 'allow r' mon 'allow rw' osd 'allow rw pool=rbdpool'updated caps for client.test[root@ceph-admin ~]# ceph auth get client.testexported keyring for client.test[client.test]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow rw"caps mgr = "allow r"caps mon = "allow rw"caps osd = "allow rw pool=rbdpool"[root@ceph-admin ~]#提示：该命令会覆盖用户现有权限因此建立事先使用ceph auth get TYPE.ID命令查看用户的caps；若是为添加caps，则需要先指定现有的caps；若为删除某些权限，则对应权限不指定即可；
删除用户命令：ceph auth del TYPE.ID
[root@ceph-admin ~]# ceph auth del client.testupdated[root@ceph-admin ~]# ceph auth del client.tomupdated[root@ceph-admin ~]# ceph auth del client.jerryupdated[root@ceph-admin ~]# ceph auth del client.testuserupdated[root@ceph-admin ~]# ceph auth get client.testuserError ENOENT: failed to find client.testuser in keyring[root@ceph-admin ~]#Keyring
客户端访问Ceph集群时，客户端会于本地查找密钥环， 默认情况下，Ceph会使用以下四个密钥环名称预设密钥环；
? /etc/ceph/cluster-name.user-name.keyring：保存单个用户的keyring? /etc/ceph/cluster.keyring：保存多个用户的keyring? /etc/ceph/keyring? /etc/ceph/keyring.bin
cluster-name是为集群名称，user-name是为用户标识（TYPE.ID）， client.admin用户的在名为ceph的集群上的密钥环文件名为ceph.client.admin.keyring；
管理keyring
创建keyring命令：ceph-authtool --create-keyring /path/to/kerying
[root@ceph-admin ~]# ceph-authtool --create-keyring ./client.abc.keyringcreating ./client.abc.keyring[root@ceph-admin ~]# cat ./client.abc.keyring[root@ceph-admin ~]#提示：创建keyring文件，里面没有任何内容，我们需要用ceph auth add 添加用户，然后通过ceph auth get或export命令将对应用户信息导入到对应keyring文件即可；这里说一下keyring文件的命名规则 ， keyring文件一般应该保存于/etc/ceph目录中，以便客户端能自动查找；创建包含多个用户的keyring文件时，应该使用cluster-name.keyring作为文件名；创建仅包含单个用户的kerying文件时，应该使用cluster-name.user-name.keyring作为文件名；这个是规范的keyring命名方式；
将用户的keyring合并至一个统一的keyring文件中命令：ceph-authtool /etc/ceph/cluster-name.keyring --import-key /etc/ceph/cluster-name.user-name.keyring
[root@ceph-admin ~]# lltotal 16-rw-r--r-- 1 root root 1568 Sep 25 11:40 ceph-deploy-ceph.log-rw------- 1 root root0 Oct2 00:57 client.abc.keyring-rw-r--r-- 1 root root151 Oct2 00:14 client.admin.cluster.keyring-rw-r--r-- 1 root root151 Oct2 00:14 client.admin.keyring-rw-r--r-- 1 root root164 Oct2 00:43 client.test.keyring[root@ceph-admin ~]# cat client.test.keyring[client.test]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow *"caps mgr = "allow *"caps mon = "allow r"caps osd = "allow rw pool=rbdpool"[root@ceph-admin ~]# ceph-authtool ./client.test.keyring --import-keyring ./client.admin.keyringimporting contents of ./client.admin.keyring into ./client.test.keyring[root@ceph-admin ~]# cat client.test.keyring[client.admin]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow *"caps mgr = "allow *"caps mon = "allow *"caps osd = "allow *"[client.test]key = AQB94C1jTO8jJhAAY4Zhy40wduyIONnRqxtkEA==caps mds = "allow *"caps mgr = "allow *"caps mon = "allow r"caps osd = "allow rw pool=rbdpool"[root@ceph-admin ~]#使用ceph-authtool命令管理用户
ceph-authtool命令可直接创建用户、授予caps并创建keyring
命令使用帮助
[root@ceph-admin ~]# ceph-authtool -husage: ceph-authtool keyringfile [OPTIONS]...where the options are:-l, --listwill list all keys and capabilities present inthe keyring-p, --print-keywill print an encoded key for the specifiedentityname. This is suitable for the'mount -o secret=..' argument-C, --create-keyringwill create a new keyring, overwriting anyexisting keyringfile-g, --gen-keywill generate a new secret key for thespecified entityname--gen-print-keywill generate a new secret key without set itto the keyringfile, prints the secret to stdout--import-keyring FILEwill import the content of a given keyringinto the keyringfile-n NAME, --name NAMEspecify entityname to operate on-u AUID, --set-uid AUIDsets the auid (authenticated user id) for thespecified entityname-a BASE64, --add-key BASE64will add an encoded key to the keyring--cap SUBSYSTEM CAPABILITYwill set the capability for given subsystem--caps CAPSFILEwill set all of capabilities associated with agiven key, for all subsystems--mode MODEwill set the desired file mode to the keyringe.g: '0644', defaults to '0600'[root@ceph-admin ~]#
推荐阅读
- 分布式存储系统之Ceph集群存储池操作
- 阴阳师剧情收录系统有什么功能
- 分布式存储系统之Ceph集群存储池、PG 与 CRUSH
- 苹果ios14.7新功能_苹果ios14.7系统怎么样
- centos7系统资源限制整理
- 引擎之旅 Chapter.4 日志系统
- 分布式存储系统之Ceph集群状态获取及ceph配置文件说明
- 分布式存储系统之Ceph集群访问接口启用
- 分布式存储系统之Ceph集群部署
- ERP 系统的核心是什么？有什么作用？