Ceph » CephFS

The fs/operations module of the mgr removes mon caps (should be at least `allow r`) from a cephx key when doing `fs subvolume deauthorize`.
This can be problematic if the same cephx key is used to access multiple subvolumes, as upon deauthorization, the key will miss caps on the mon and clients will not be able to check in when attempting to mount.

Steps to reproduce:
1. Create two subvolumes (test1, test2) and authorize the same cephx (mykey) for both:

$ ceph fs subvolume create cephfs test1 --size 1048576
$ ceph fs subvolume create cephfs test2 --size 1048576
$ ceph fs subvolume authorize cephfs test1 mykey
$ ceph fs subvolume authorize cephfs test2 mykey
$ ceph auth get client.mykey
[client.mykey]
    key = AQCqsshmotUnGRAAVj3oV2Tvz5BPfc4pOpdvcA==
    caps mds = "allow rw path=/volumes/_nogroup/test1/c8d593a5-3736-4e0c-8d88-7fef9a098e31,allow rw path=/volumes/_nogroup/test2/8a2e0430-2363-47e5-b709-c1108e2423a6" 
    caps mon = "allow r" 
    caps osd = "allow rw pool=cephfs_data,allow rw pool=cephfs_data" 

2. Deauthorize the key for any of the two subvolumes (test2 here)

$ ceph fs subvolume deauthorize cephfs test2 mykey
$  ceph auth get client.mykey
[client.mykey]
    key = AQCqsshmotUnGRAAVj3oV2Tvz5BPfc4pOpdvcA==
    caps mds = "allow rw path=/volumes/_nogroup/test1/c8d593a5-3736-4e0c-8d88-7fef9a098e31" 
    caps osd = "allow rw pool=cephfs_data" 
exported keyring for client.mykey

OpenStack Manila uses `fs subvolume deauthorize` when removing access to a key and when deleting a share.
If the user uses the same key for multiple share, deleting any will lock the clients out also for all the remaining shares.