1.簡介
1.1 本文解決什么問題？
- 如何在ceph對象存儲創(chuàng)建使用同名用戶
- 如何在ceph對象存儲中創(chuàng)建使用同名bucket
1.2問題描述
公司有2個張三庵佣，一天北京的張三在使用公司對象存儲用自己的名字創(chuàng)建用戶時歉胶，提示用戶已存在，原來上海的張三搶先創(chuàng)建了“張三”的用戶巴粪，那么現在就存在一個問題：在不重起用戶名的情況下怎么創(chuàng)建2個張三呢（即為同名用戶）通今？（此段為做作的引入，肛根，哈哈哈）
1.3multi-tenancy概述
ceph J版本以前辫塌，集群中不允許有同名的bucket和user，這可能在實際使用過程中帶來某些不便派哲。從J版本開始ceph 引入multi-tenancy功能臼氨，將同名user/bucket隔離在不同的tenant下，使同一集群中可創(chuàng)建同名user/bucket芭届。每個user/bucket都位于一個tenant下储矩，相互隔離，各不影響褂乍。為了兼容前版本椰苟，引入隱式空字符串“”tenant，如果創(chuàng)建用戶不顯式指定tenant，則默認加入“”tenant中。每當在沒有顯式tenant的情況下引用user/bucket時垄潮，都會從執(zhí)行操作的用戶那里獲取隱式tenant"".
2 .實測創(chuàng)建同名用戶
測試環(huán)境說明：
ceph版本:Nautilus 14.2.8
創(chuàng)建用戶時摊鸡，可選參數“--tenant”可指定用戶存在 哪個tenant下裕寨，不指定默認為“”
例如創(chuàng)建為北京的張三指定tenant Beijing
[root@node44 ~]# radosgw-admin user create --tenant=Beijing --uid=zhangsan --display-name="beijing zhangsan" --access-key="beijingzhangsan" --secret-key="daemon"
{
"user_id": "Beijing$zhangsan",
"display_name": "beijing zhangsan",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"subusers": [],
"keys": [
{
"user": "Beijing$zhangsan",
"access_key": "beijingzhangsan",
"secret_key": "daemon"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"default_storage_class": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"temp_url_keys": [],
"type": "rgw",
"mfa_ids": []
}
[root@node44 ~]#
為上海的張三指定tenant為上海
[root@node44 ~]# radosgw-admin user create --tenant=Shanghai --uid=zhangsan --display-name="shanghai zhangsan" --access-key="shanghaizhangsan" --secret-key="123456"
{
"user_id": "Shanghai$zhangsan",
"display_name": "shanghai zhangsan",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"subusers": [],
"keys": [
{
"user": "Shanghai$zhangsan",
"access_key": "shanghaizhangsan",
"secret_key": "123456"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"default_storage_class": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"temp_url_keys": [],
"type": "rgw",
"mfa_ids": []
}
[root@node44 ~]#
查看創(chuàng)建結果：
[root@node44 ~]# radosgw-admin user list
[
"Beijing$zhangsan",
"test",
"Shanghai$zhangsan"
]
[root@node44 ~]#
從創(chuàng)建結果可以看出radosgw-admin 創(chuàng)建用戶時指定的--uid均為zhangsan竹习，并未報錯uid已存在伴箩，實際上創(chuàng)建處理的用戶uid為<tenant>$<uid>形式孵班，不指定--tenant情況則為<uid>形式
查看不同tenant下同一用戶名命令：
[root@node44 ~]# radosgw-admin user list
[
"Beijing$zhangsan",
"test",
"Shanghai$zhangsan"
]
[root@node44 ~]# radosgw-admin user info --uid=zhangsan
could not fetch user info: no user info saved
[root@node44 ~]#
[root@node44 ~]# radosgw-admin user info --uid=zhangsan --tenant Beijing
{
"user_id": "Beijing$zhangsan",
"display_name": "beijing zhangsan",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"subusers": [],
"keys": [
{
"user": "Beijing$zhangsan",
"access_key": "beijingzhangsan",
"secret_key": "daemon"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"default_storage_class": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"temp_url_keys": [],
"type": "rgw",
"mfa_ids": []
}
[root@node44 ~]# radosgw-admin user info --uid=zhangsan --tenant Shanghai
{
"user_id": "Shanghai$zhangsan",
"display_name": "shanghai zhangsan",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"subusers": [],
"keys": [
{
"user": "Shanghai$zhangsan",
"access_key": "shanghaizhangsan",
"secret_key": "123456"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"default_storage_class": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
},
"temp_url_keys": [],
"type": "rgw",
"mfa_ids": []
}
[root@node44 ~]#
3.創(chuàng)建同名bucket
創(chuàng)建bucket時赠潦，無需指定tenant叫胖，rgw會根據ak和sk去隔離用戶數據到用戶tenant下，如果在創(chuàng)建用戶時她奥，指定的ak瓮增、sk一樣，會報如下錯：
[root@node44 ~]# radosgw-admin user create --tenant=Chengdu --uid=zhangsan --display-name="shanghai zhangsan" --access-key="shanghaizhangsan" --secret-key="123456"
could not create user: unable to parse parameters, user id mismatch, operation id: Shanghai$zhangsan does not match: Chengdu$zhangsan
[root@node44 ~]#
通過s3browser創(chuàng)建同名bucket：
查看創(chuàng)建結果：
[root@node44 ~]# radosgw-admin bucket list
[
"Shanghai/zhangsan_bucket",
"Beijing/zhangsan_bucket",
"testbucket"
]
[root@node44 ~]# radosgw-admin bucket stats --bucket=Shanghai/zhangsan_bucket
{
"bucket": "zhangsan_bucket",
"num_shards": 8,
"tenant": "Shanghai",
"zonegroup": "14b51936-68ca-446c-81d6-88f3bc33f000",
"placement_rule": "default-placement",
"explicit_placement": {
"data_pool": "",
"data_extra_pool": "",
"index_pool": ""
},
"id": "68ca434f-cfed-432c-87fe-7e28761c05cb.2101966.2",
"marker": "68ca434f-cfed-432c-87fe-7e28761c05cb.2101966.2",
"index_type": "Normal",
"owner": "Shanghai$zhangsan",
"ver": "0#1,1#1,2#1,3#1,4#1,5#2,6#1,7#1",
"master_ver": "0#0,1#0,2#0,3#0,4#0,5#0,6#0,7#0",
"mtime": "2020-12-30 08:20:28.794223Z",
"max_marker": "0#,1#,2#,3#,4#,5#,6#,7#",
"usage": {
"rgw.main": {
"size": 21084,
"size_actual": 24576,
"size_utilized": 21084,
"size_kb": 21,
"size_kb_actual": 24,
"size_kb_utilized": 21,
"num_objects": 1
}
},
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
}
}
[root@node44 ~]#
[root@node44 ~]# radosgw-admin bucket stats --bucket=Beijing/zhangsan_bucket
{
"bucket": "zhangsan_bucket",
"num_shards": 8,
"tenant": "Beijing",
"zonegroup": "14b51936-68ca-446c-81d6-88f3bc33f000",
"placement_rule": "default-placement",
"explicit_placement": {
"data_pool": "",
"data_extra_pool": "",
"index_pool": ""
},
"id": "68ca434f-cfed-432c-87fe-7e28761c05cb.2101966.1",
"marker": "68ca434f-cfed-432c-87fe-7e28761c05cb.2101966.1",
"index_type": "Normal",
"owner": "Beijing$zhangsan",
"ver": "0#1,1#1,2#1,3#1,4#1,5#2,6#1,7#1",
"master_ver": "0#0,1#0,2#0,3#0,4#0,5#0,6#0,7#0",
"mtime": "2020-12-30 08:19:33.146366Z",
"max_marker": "0#,1#,2#,3#,4#,5#,6#,7#",
"usage": {
"rgw.main": {
"size": 21084,
"size_actual": 24576,
"size_utilized": 21084,
"size_kb": 21,
"size_kb_actual": 24,
"size_kb_utilized": 21,
"num_objects": 1
}
},
"bucket_quota": {
"enabled": false,
"check_on_raw": false,
"max_size": -1,
"max_size_kb": 0,
"max_objects": -1
}
}
[root@node44 ~]#
4.結束
本文只是簡單測試了multi-tenancy功能哩俭，為policy使用前的簡單測試使用了解绷跑，后續(xù)若有問題，持續(xù)更新凡资。
參考鏈接：
https://docs.ceph.com/en/latest/radosgw/multitenancy/#administering-users-with-explicit-tenants
