Nova isn't using rbd direct snapshot when config Nova, Glance to use Ceph storage

Tested on MOS8.0, MOS 9.0

When using Ceph as storage backend for Nova,Glance and Cinder, instance snapshot doesn't take the benefit of Ceph rbd direct snapshot which is implemented by this blueprint https://blueprints.launchpad.net/nova/+spec/rbd-instance-snapshots, the root cause is that Nova's compute user of ceph storage has no write permission on Glance's images pool of Ceph.

Here is output of a MOS 8 env:

root@node-5:~# ceph auth list
installed auth entries:

osd.0
        key: AQAYIyBYoTKRFhAA/hX+kv9Ifbi3D7siaWxiUQ==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.1
        key: AQAZIyBY+DzzIRAA4pRFbyZbOk4YluBcSDxc/g==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.2
        key: AQAZIyBYUaFkIhAAXi0JqyzeOPcJtKu/im8+2w==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.3
        key: AQAdIyBYYrvXHhAACMy/FVEGQjc/1eJ9dYbUAw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.4
        key: AQAfIyBYRJ4RAxAADRe0f9fL02jM8eYB+4fFiA==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.5
        key: AQAoIyBYo2G1ARAAJFmruttfAWowpJ5jDRD8YA==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.6
        key: AQAnIyBYxTWmOhAARt8PgeKacXkI46DcnGV/Ug==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.7
        key: AQAsIyBYiPM3JRAAB6pqrrn3t4/sasCcEGOQlw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.8
        key: AQA2IyBY1OEsGRAAJK/ByRLpePiIKkyM4iNpBw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
client.admin
        key: AQCbFiBYFpAPLhAAHHiuziNMdYvFi2ntYA3d4Q==
        caps: [mds] allow
        caps: [mon] allow *
        caps: [osd] allow *
client.backups
        key: AQBoJCBYFMazNBAApsoqmuSwGJk62GFk/VwG/w==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=backups, allow rwx pool=volumes
client.bootstrap-mds
        key: AQCcFiBYzGe4GxAAEqHfAlZHhEF5/I8bCokrOg==
        caps: [mon] allow profile bootstrap-mds
client.bootstrap-osd
        key: AQCcFiBYUiXPABAAV7h+FzcgLBuWAjm4AkspBg==
        caps: [mon] allow profile bootstrap-osd
client.bootstrap-rgw
        key: AQCcFiBYEjI3DxAAL5Xgu31flbbSZq4HuXuxRg==
        caps: [mon] allow profile bootstrap-rgw
client.compute
        key: AQChJCBYmX6zORAAQkjpehi/Zu5tgaH0u9vlpg==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rx pool=images, allow rwx pool=compute
client.images
        key: AQBmJCBY/xp7ABAAVeNRf/312lAGyIf2e5eZkw==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=images
client.radosgw.gateway
        key: AQCxFiBYhoqDIxAACJ+URYYxnZJUuOvE445zBQ==
        caps: [mon] allow rw
        caps: [osd] allow rwx
client.volumes
        key: AQBnJCBYw8GyBBAAsPsOlbRE4DRHt0kIBCuoqw==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rx pool=images