s3cmd command can write to a read only cluster zone

This document (7023796) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Enterprise Storage 5

Situation

The command s3cmd put /file.txt s3://bucket/ works when writing to a read only zone in a multizone or multisite ceph configuration. In this example, ses5node118 is the read/write zone, and ses5node119 is the read only zone.

The admin user credentials were used in the ~/.s3cfg file to create and write to the s3://bucket

cephadmin:~ # cat ~/.s3cfg
[default]
access_key = <admin access key>
secret_key = <admin secret key>
host_base = ses5node119
host_bucket = %bucket.ses5node119
...

The read only zone is confirmed.

cephadmin:~ # radosgw-admin period get
{
...
                "zones": [
                    {
                        "id": "5041248c-0969-4460-9ae6-83031a7f8035",
                        "name": "ses5node119",
                        "endpoints": [
                            "http://ses5node119:80"
                        ],
                        "log_meta": "false",
                        "log_data": "true",
                        "bucket_index_max_shards": 0,
                        "read_only": "true",
                        "tier_type": "",
                        "sync_from_all": "true",
                        "sync_from": []
                    },
...
    "realm_id": "34edb67c-d5d3-409f-9243-68661371d517",
    "realm_name": "support",
    "realm_epoch": 2
}

Resolution

1. Create a new regular rados gateway user.

cephadmin:~ # radosgw-admin user create --uid=joe --display-name="Joe User"
{
    "user_id": "joe",
    "display_name": "Joe User",
...
    "keys": [
        {
            "user": "joe",
            "access_key": "<Joe's Access Key>",
            "secret_key": "<Joe's Secret Key>"
        }
    ],
...
}

2. Write down the access and secret keys.
3. Update the ~/.s3cfg file on the client replacing the keys and the host, such that the host is the read/write zone:

access_key = <admin access key>
secret_key = <admin secret key>
host_base = ses5node119
host_bucket = %bucket.ses5node119

with:

access_key = <Joe's Access Key>
secret_key = <Joe's Secret Key>
host_base = ses5node118
host_bucket = %bucket.ses5node118

Cause

Engineering confirmed the admin user can write to a read only zone. Only non-admin users are restricted.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.