From 566a489bbef8ddea4469f7a494b533d60476f016 Mon Sep 17 00:00:00 2001
From: Jean-Charles Lopez <jl970p@att.com>
Date: Fri, 5 Oct 2018 15:22:23 -0700
Subject: [PATCH] Restrict libvirt Ceph access scope to what is needed only.

Change-Id: I78bffe6764e9cbb16b2a615be766c910ba5d4e48
---
 libvirt/templates/bin/_ceph-keyring.sh.tpl | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/libvirt/templates/bin/_ceph-keyring.sh.tpl b/libvirt/templates/bin/_ceph-keyring.sh.tpl
index 418a40c27..460bfcdb1 100644
--- a/libvirt/templates/bin/_ceph-keyring.sh.tpl
+++ b/libvirt/templates/bin/_ceph-keyring.sh.tpl
@@ -26,12 +26,11 @@ cat > ${KEYRING} <<EOF
     key = {{ .Values.conf.ceph.cinder.keyring }}
 EOF
 {{- else }}
-if ! [ "x${CEPH_CINDER_USER}" == "xadmin"]; then
-  #NOTE(Portdirect): Determine proper privs to assign keyring
+if ! [ "x${CEPH_CINDER_USER}" == "xadmin" ]; then
+  #NOTE(JCL): Restrict access to the cluster to only what is needed. MON Read only and RBD access.
   ceph auth get-or-create client.${CEPH_CINDER_USER} \
-    mon "allow *" \
-    osd "allow *" \
-    mgr "allow *" \
+    mon "profile rbd" \
+    osd "profile rbd" \
     -o ${KEYRING}
 
   rm -f /etc/ceph/ceph.client.admin.keyring