rgw: how to prevent rgw user from creating a new bucket?

rgw: how to prevent rgw user from creating a new bucket?

[Yang Joseph]

Hello,

I would like only to allow the user to read the object in a already 
existed bucket, and not allow users
to create new bucket. It supposed to execute the following command:

$ radosgw-admin metadata put user:test3 < ...
   ...
         "caps": [
             {
                 "type": "buckets",
                 "perm": "read"
             }

But why user test3 can still create new bucket after I have set its caps 
to "buckets=read"?

thx,

Yang Honggang

Re: rgw: how to prevent rgw user from creating a new bucket?

[Yehuda Sadeh-Weinraub]

On Fri, Dec 2, 2016 at 3:18 AM, Yang Joseph <joseph.yang-/BaA95PH9wJWk0Htik3J/w@public.gmane.org> wrote:
> Hello,
>
> I would like only to allow the user to read the object in a already existed
> bucket, and not allow users
> to create new bucket. It supposed to execute the following command:
>
> $ radosgw-admin metadata put user:test3 < ...
>   ...
>         "caps": [
>             {
>                 "type": "buckets",
>                 "perm": "read"
>             }
>
> But why user test3 can still create new bucket after I have set its caps to
> "buckets=read"?
>


Because this cap is unrelated. iirc starting at jewel you can do:

$ radosgw-admin user modify --uid=test3 --max-buckets=-1

Yehuda

Re: [ceph-users] rgw: how to prevent rgw user from creating a new bucket?

[Yang Joseph]

Thank you very much for your response.

I‘m confused about what this cap related to?

On 12/03/2016 12:13 AM, Yehuda Sadeh-Weinraub wrote:
> On Fri, Dec 2, 2016 at 3:18 AM, Yang Joseph <joseph.yang@xtaotech.com> wrote:
>> Hello,
>>
>> I would like only to allow the user to read the object in a already existed
>> bucket, and not allow users
>> to create new bucket. It supposed to execute the following command:
>>
>> $ radosgw-admin metadata put user:test3 < ...
>>    ...
>>          "caps": [
>>              {
>>                  "type": "buckets",
>>                  "perm": "read"
>>              }
>>
>> But why user test3 can still create new bucket after I have set its caps to
>> "buckets=read"?
>>
>
> Because this cap is unrelated. iirc starting at jewel you can do:
>
> $ radosgw-admin user modify --uid=test3 --max-buckets=-1
>
> Yehuda
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>