Minimal capabilities for RBD clients

Why this matters in production

RBD clients are the most numerous credentials in a typical cluster — one per hypervisor, per Kubernetes node, per backup agent. They are also the most commonly over-privileged, because allow * works and takes no thought. Each over-privileged client is a host that, if compromised, can read and destroy every pool in the cluster.

The minimal grant

ceph auth get-or-create client.rbd-vms \
    mon 'profile rbd' \
    osd 'profile rbd pool=rbd-vms' \
    -o /etc/ceph/ceph.client.rbd-vms.keyring

profile rbd grants exactly what the RBD client library needs: the monitor reads to fetch maps, and on the OSD side read, write, and the specific class methods RBD uses for image headers, object maps, snapshots, and exclusive locks.

Compare it with the hand-written equivalent:

osd 'allow rwx pool=rbd-vms'

This works today. It is broader than the profile in some respects and narrower in others, and it will not track changes across Ceph releases. Use the profile.

Read-only clients

ceph auth get-or-create client.rbd-backup \
    mon 'profile rbd' \
    osd 'profile rbd-read-only pool=rbd-vms'

A backup agent that snapshots and reads should not be able to write. The read-only profile permits the class methods needed for reading and snapshotting while denying data modification.

Images with an EC data pool

An RBD image using --data-pool needs access to both pools:

ceph auth get-or-create client.rbd-bulk \
    mon 'profile rbd' \
    osd 'profile rbd pool=rbd-bulk-meta, profile rbd pool=rbd-bulk-data'

Omitting the data pool produces a client that can see the image and cannot read its contents — a confusing failure worth recognising.

Namespace-scoped clients

For multi-tenant use, scope to a namespace within a shared pool:

rbd namespace create rbd-shared/tenant-a
ceph auth get-or-create client.tenant-a \
    mon 'profile rbd' \
    osd 'profile rbd pool=rbd-shared namespace=tenant-a'

What over-privilege costs

osd 'allow *' on a hypervisor client means a compromise of that host yields:

• Read access to every pool, including other tenants’ data
• Write and delete access to every pool
• The ability to destroy data that no VM on that host ever touched

The blast radius of a compromised host becomes the entire cluster rather than the images that host was serving.

Quiz

Production discipline

Use one entity per role or environment rather than one per fleet, so revocation and rotation can be surgical and session data identifies the consumer. Prefer the RBD profiles over hand-written capabilities — the blocklist permission alone justifies it, and the failure it prevents is one that appears only during recovery from a crash.

Cross-course references

• Kubernetes: per-namespace CSI credentials achieve the same separation
• Linux: distinct service accounts per application is the same principle at the OS level