ceph 的常规操作应该都会，这里就不多说了。下面主要介绍一下针对于不同的pool创建不用的用户秘钥给不同的客户端使用。这样能保证权限控制。
- 在ceph集群上创建用户 这里创建一个名字为client.wzl的用户，且只能使用指定的pool
[root@ceph-admin ceph]# ceph auth get-or-create client.wzl mon 'allow r' osd 'allow class-read object_prefix rbd_children,allow rwx pool=test_pool7'[client.wzl] key = AQA97UFan/kDOhAA1exvZaY8wwE0G+v6y06spg==
创建好对应pool的用户之后系统就自动生成一个秘密
-
把秘钥分配给需要的客户端
[root@ceph-admin ceph]# ceph auth get-or-create client.wzl | tee /etc/ceph/ceph.client.wzl.keyring[client.wzl] key = AQA97UFan/kDOhAA1exvZaY8wwE0G+v6y06spg==[root@ceph-admin ceph]# ll /etc/ceph/|grep wzl-rw-r--r-- 1 root root 61 12月 26 14:35 ceph.client.wzl.keyring
只需要把秘钥文件ceph.client.wzl.keyring 放在客户端的/etc/ceph/目录下就可以了
-
用用户名验证
由于这里没有使用admin用户，所以每次操作都要使用用户名。#查看ceph 集群信息[root@ceph-admin ceph]# ceph -s --name client.wzl cluster 53fe37a5-7ee7-4190-a8ea-a0221648294c health HEALTH_OK monmap e4: 2 mons at {ceph-admin=172.18.1.231:6789/0,ceph-node1=172.18.1.232:6789/0} election epoch 382, quorum 0,1 ceph-admin,ceph-node1 fsmap e2: 0/0/1 up osdmap e3176: 3 osds: 3 up, 3 in flags sortbitwise,require_jewel_osds pgmap v2810691: 1096 pgs, 19 pools, 47972 MB data, 15138 objects 153 GB used, 447 GB / 600 GB avail 1096 active+clean client io 6132 B/s wr, 0 op/s rd, 2 op/s wr# 创建一个块设备[root@ceph-admin ceph]# rbd create rbd/rbd1226 --size 1G --name client.wzl2017-12-26 15:13:35.938617 7f92cc8f2d80 -1 auth: unable to find a keyring on /etc/ceph/ceph.client.wzl.keyring,/etc/ceph/ceph.keyring,/etc/ceph/keyring,/etc/ceph/keyring.bin: (2) No such file or directory2017-12-26 15:13:35.938637 7f92cc8f2d80 -1 monclient(hunting): ERROR: missing keyring, cannot use cephx for authentication2017-12-26 15:13:35.938639 7f92cc8f2d80 0 librados: client.wzl initialization error (2) No such file or directoryrbd: couldn't connect to the cluster!# 看由于设置了用户client.wzl的权限值能在池test_pool7上有权限使用，所以在其他池上创建块设备就报错没有权限。[root@ceph-admin ceph]# rbd create test_pool7/rbd01 --size 1G --name client.wzl查看用户列表
[root@ceph-admin ceph]# ceph auth listinstalled auth entries:osd.0 key: AQDl0MRZEuoZCxAAV9TQyfkY6QBIT3VjRkbmPA== caps: [mon] allow profile osd caps: [osd] allow *osd.1 key: AQBAyMRZOVSMCBAAO1NZV5SlXwifclN2XDTp0g== caps: [mon] allow profile osd caps: [osd] allow *osd.2 key: AQBs2MRZ8gBJARAAOG6XphV6r8kTgD5RGu2jKg== caps: [mon] allow profile osd caps: [osd] allow *client.133 key: AQBalrhZbfg2AhAAyJpEemuT+nNMThTc03QF9w== caps: [mon] allow r caps: [osd] allow rw pool=liverpoolclient.admin key: AQAf/qxZwV5aJxAA5JHbVGLQUFM4LZV4/Ry94g== caps: [mds] allow * caps: [mon] allow * caps: [osd] allow *client.backup key: AQBnBARaqQgxExAAcv/cU/jYvmD+WiWr4QiBQw==client.bootstrap-mds key: AQAj/qxZRZ/nLBAAqu2QLUjEm6nE60u3trWMBw== caps: [mon] allow profile bootstrap-mdsclient.bootstrap-mgr key: AQAs/qxZpAr6ExAAZFBfbPvPCkYhSVQYami8Dg== caps: [mon] allow profile bootstrap-mgrclient.bootstrap-osd key: AQAg/qxZNJBiAhAAR2tMVUHQ3cA9TlU9LURbUw== caps: [mon] allow profile bootstrap-osdclient.bootstrap-rgw key: AQAj/qxZXVi5GBAAgs9R2P4rQ8/eAYaDqjhMnw== caps: [mon] allow profile bootstrap-rgwclient.cinder key: AQAaAQRa24wlKRAAZGJsk/TsfzqkCAK6J5HXVQ== caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rwx pool=vms, allow rx pool=imagesclient.cinder-backup key: AQCYAgRaOmLcKxAADX29hycFvtuFwoUHwkAzfA== caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_chindren,allow rwx pool=volumes,allow rwx pool=vms allow rx pool=imagesclient.glance key: AQBuAgRaYfiOJxAAtcMmV0qXcPTdI3R9Ra9xYA== caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=imagesclient.rbd key: AQD4skFaGPOeGBAA6m0aRR7iEY3XbDJmzBI4mg== caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_chindren,allow rwx pool=rbdclient.restapi key: AQBNO79ZFRroMhAA0WfM8rtARxczlTwj5cZmMg== caps: [mds] allow caps: [mon] allow * caps: [osd] allow *client.rgw.ceph-admin key: AQB6tM1Z0DYQLRAAu8L9e1BHcNXuklGQzOZk7g== caps: [mon] allow rw caps: [osd] allow rwxclient.vmpool1 key: AQAfvd1ZFzvyGhAAhvQnV1KIKtiRzcJlRC1FSg== caps: [mon] allow r caps: [osd] allow rwx pool=vmpool1client.wzl key: AQA97UFan/kDOhAA1exvZaY8wwE0G+v6y06spg== caps: [mon] allow r caps: [osd] allow class-read object_prefix rbd_chindren,allow rwx pool=test_pool7
更多的用户权限修改等操作参见http://docs.ceph.org.cn/rados/operations/user-management/#id3