Ceph rgw multi-tenancy多租户实测

1.简介

1.1 本文解决什么问题？

如何在ceph对象存储创建使用同名用户
如何在ceph对象存储中创建使用同名bucket

1.2问题描述

公司有2个张三，一天北京的张三在使用公司对象存储用自己的名字创建用户时，提示用户已存在，原来上海的张三抢先创建了“张三”的用户，那么现在就存在一个问题：在不重起用户名的情况下怎么创建2个张三呢（即为同名用户）？（此段为做作的引入，，哈哈哈）

1.3multi-tenancy概述

ceph J版本以前，集群中不允许有同名的bucket和user，这可能在实际使用过程中带来某些不便。从J版本开始ceph 引入multi-tenancy功能，将同名user/bucket隔离在不同的tenant下，使同一集群中可创建同名user/bucket。每个user/bucket都位于一个tenant下，相互隔离，各不影响。为了兼容前版本，引入隐式空字符串“”tenant，如果创建用户不显式指定tenant，则默认加入“”tenant中。每当在没有显式tenant的情况下引用user/bucket时，都会从执行操作的用户那里获取隐式tenant"".

2 .实测创建同名用户

测试环境说明：
ceph版本:Nautilus 14.2.8

创建用户时，可选参数“--tenant”可指定用户存在哪个tenant下，不指定默认为“”
例如创建为北京的张三指定tenant Beijing

[root@node44 ~]#  radosgw-admin user create --tenant=Beijing --uid=zhangsan --display-name="beijing zhangsan" --access-key="beijingzhangsan" --secret-key="daemon"
{
    "user_id": "Beijing$zhangsan",
    "display_name": "beijing zhangsan",
    "email": "",
    "suspended": 0,
    "max_buckets": 1000,
    "subusers": [],
    "keys": [
        {
            "user": "Beijing$zhangsan",
            "access_key": "beijingzhangsan",
            "secret_key": "daemon"
        }
    ],
    "swift_keys": [],
    "caps": [],
    "op_mask": "read, write, delete",
    "default_placement": "",
    "default_storage_class": "",
    "placement_tags": [],
    "bucket_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "user_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}

[root@node44 ~]#

为上海的张三指定tenant为上海

[root@node44 ~]#  radosgw-admin user create --tenant=Shanghai --uid=zhangsan --display-name="shanghai zhangsan" --access-key="shanghaizhangsan" --secret-key="123456"
{
    "user_id": "Shanghai$zhangsan",
    "display_name": "shanghai zhangsan",
    "email": "",
    "suspended": 0,
    "max_buckets": 1000,
    "subusers": [],
    "keys": [
        {
            "user": "Shanghai$zhangsan",
            "access_key": "shanghaizhangsan",
            "secret_key": "123456"
        }
    ],
    "swift_keys": [],
    "caps": [],
    "op_mask": "read, write, delete",
    "default_placement": "",
    "default_storage_class": "",
    "placement_tags": [],
    "bucket_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "user_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}

[root@node44 ~]#

查看创建结果：

[root@node44 ~]# radosgw-admin user list
[
    "Beijing$zhangsan",
    "test",
    "Shanghai$zhangsan"
]
[root@node44 ~]#

从创建结果可以看出radosgw-admin 创建用户时指定的--uid均为zhangsan，并未报错uid已存在，实际上创建处理的用户uid为$形式，不指定--tenant情况则为形式

查看不同tenant下同一用户名命令：

[root@node44 ~]# radosgw-admin user list
[
    "Beijing$zhangsan",
    "test",
    "Shanghai$zhangsan"
]
[root@node44 ~]# radosgw-admin user info --uid=zhangsan
could not fetch user info: no user info saved
[root@node44 ~]# 
[root@node44 ~]# radosgw-admin user info --uid=zhangsan --tenant Beijing
{
    "user_id": "Beijing$zhangsan",
    "display_name": "beijing zhangsan",
    "email": "",
    "suspended": 0,
    "max_buckets": 1000,
    "subusers": [],
    "keys": [
        {
            "user": "Beijing$zhangsan",
            "access_key": "beijingzhangsan",
            "secret_key": "daemon"
        }
    ],
    "swift_keys": [],
    "caps": [],
    "op_mask": "read, write, delete",
    "default_placement": "",
    "default_storage_class": "",
    "placement_tags": [],
    "bucket_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "user_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}

[root@node44 ~]# radosgw-admin user info --uid=zhangsan --tenant Shanghai
{
    "user_id": "Shanghai$zhangsan",
    "display_name": "shanghai zhangsan",
    "email": "",
    "suspended": 0,
    "max_buckets": 1000,
    "subusers": [],
    "keys": [
        {
            "user": "Shanghai$zhangsan",
            "access_key": "shanghaizhangsan",
            "secret_key": "123456"
        }
    ],
    "swift_keys": [],
    "caps": [],
    "op_mask": "read, write, delete",
    "default_placement": "",
    "default_storage_class": "",
    "placement_tags": [],
    "bucket_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "user_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}

[root@node44 ~]#

3.创建同名bucket

创建bucket时，无需指定tenant，rgw会根据ak和sk去隔离用户数据到用户tenant下，如果在创建用户时，指定的ak、sk一样，会报如下错：

[root@node44 ~]# radosgw-admin user create --tenant=Chengdu --uid=zhangsan --display-name="shanghai zhangsan" --access-key="shanghaizhangsan" --secret-key="123456"
could not create user: unable to parse parameters, user id mismatch, operation id: Shanghai$zhangsan does not match: Chengdu$zhangsan
[root@node44 ~]#

通过s3browser创建同名bucket：