Describe the bug

Currently the standard capabilities set in the capabilities.md is not enough to acquire a lock in rados that is needed when running. This can be seen when the LockExclusive is called rados returns the following error code

Failed to lock volume ID 0001-0009-rook-ceph-0000000000000001-489ccf33-13a5-40fc-8460-7dd866bc44de: rados: ret=-1, Operation not permitted

Some discussion and a naive solution how to circumvent this can be found, in this PR discussion

The Solution

It needs to be figured out what to add to the OSD caps to give only the necessary permission to do the lock operation. Further this should then be documented in the capabilities.md .