ceph-ansible/roles/ceph-dashboard/tasks/configure_dashboard.yml

---
- name: set_fact container_exec_cmd
  set_fact:
    container_exec_cmd: "{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_facts']['hostname'] }}"
  when: containerized_deployment | bool

- name: set_fact container_run_cmd
  set_fact:
    ceph_cmd: "{{ hostvars[groups[mon_group_name][0]]['container_binary'] + ' run --interactive --net=host --rm -v /etc/ceph:/etc/ceph:z --entrypoint=ceph ' + ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else 'ceph' }}"

- name: get current mgr backend - ipv4
  set_fact:
    dashboard_server_addr: "{{ ansible_facts['all_ipv4_addresses'] | ips_in_ranges(dashboard_network.split(',')) | first }}"
  when: ip_version == 'ipv4'

- name: get current mgr backend - ipv6
  set_fact:
    dashboard_server_addr: "{{ ansible_facts['all_ipv6_addresses'] | ips_in_ranges(dashboard_network.split(',')) | last }}"
  when: ip_version == 'ipv6'

- name: disable SSL for dashboard
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl false"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  when: dashboard_protocol == "http"

- name: with SSL for dashboard
  when: dashboard_protocol == "https"
  block:
    - name: enable SSL for dashboard
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl true"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

    - name: copy dashboard SSL certificate file
      copy:
        src: "{{ dashboard_crt }}"
        dest: "/etc/ceph/ceph-dashboard.crt"
        owner: root
        group: root
        mode: 0440
        remote_src: "{{ dashboard_tls_external | bool }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      when: dashboard_crt | length > 0

    - name: copy dashboard SSL certificate key
      copy:
        src: "{{ dashboard_key }}"
        dest: "/etc/ceph/ceph-dashboard.key"
        owner: root
        group: root
        mode: 0440
        remote_src: "{{ dashboard_tls_external | bool }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      when: dashboard_key | length > 0

    - name: generate and copy self-signed certificate
      when: dashboard_key | length == 0 or dashboard_crt | length == 0
      block:
        - name: set_fact subj_alt_names
          set_fact:
            subj_alt_names: >
              {% for host in groups[mgr_group_name] | default(groups[mon_group_name]) -%}
              DNS:{{ hostvars[host]['ansible_facts']['hostname'] }},DNS:{{ hostvars[host]['ansible_facts']['fqdn'] }},IP:{{ hostvars[host]['dashboard_server_addr'] }}{% if not loop.last %},{% endif %}
              {%- endfor -%}
          run_once: true

        - name: generate a Self Signed OpenSSL certificate for dashboard
          shell: |
            test -f /etc/ceph/ceph-dashboard.key -a -f /etc/ceph/ceph-dashboard.crt || \
            openssl req -new -nodes -x509 -subj '/O=IT/CN={{ dashboard_certificate_cn }}/' -addext 'subjectAltName={{ subj_alt_names | trim }}' -days 3650 -keyout /etc/ceph/ceph-dashboard.key -out /etc/ceph/ceph-dashboard.crt -extensions v3_ca
          run_once: True

        - name: slurp self-signed generated certificate for dashboard
          slurp:
            src: "/etc/ceph/{{ item }}"
          run_once: True
          with_items:
            - 'ceph-dashboard.key'
            - 'ceph-dashboard.crt'
          register: slurp_self_signed_crt

        - name: copy self-signed generated certificate on mons
          copy:
            dest: "{{ item.0.source }}"
            content: "{{ item.0.content | b64decode }}"
            owner: "{{ ceph_uid }}"
            group: "{{ ceph_uid }}"
            mode: "{{ '0600' if item.0.source.split('.')[-1] == 'key' else '0664' }}"
          delegate_to: "{{ item.1 }}"
          run_once: True
          with_nested:
            - "{{ slurp_self_signed_crt.results }}"
            - "{{ groups[mon_group_name] }}"

    - name: import dashboard certificate file
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config-key set mgr/dashboard/crt -i /etc/ceph/ceph-dashboard.crt"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

    - name: import dashboard certificate key
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config-key set mgr/dashboard/key -i /etc/ceph/ceph-dashboard.key"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

- name: "set the dashboard port ({{ dashboard_port }})"
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/server_port {{ dashboard_port }}"
  changed_when: false
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true

- name: "set the dashboard SSL port ({{ dashboard_port }})"
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl_server_port {{ dashboard_port }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false
  failed_when: false # Do not fail if the option does not exist, it only exists post-14.2.0

- name: config the current dashboard backend
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/{{ hostvars[item]['ansible_facts']['hostname'] }}/server_addr {{ hostvars[item]['dashboard_server_addr'] }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  changed_when: false
  run_once: true
  with_items: '{{ groups[mgr_group_name] | default(groups[mon_group_name]) }}'

- name: disable mgr dashboard module (restart)
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module disable dashboard"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false

- name: enable mgr dashboard module (restart)
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module enable dashboard"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false

- name: check dashboard password in file option command
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-set-password"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false
  failed_when: false
  register: dashboard_password_in_file_option

- name: set_fact dashboard_password_from_stdin
  set_fact:
    dashboard_password_from_stdin: "{{ ' -i ' in dashboard_password_in_file_option.stderr }}"
  run_once: true

- name: check if dashboard admin user exists
  command: timeout --foreground -s KILL 10 {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-show {{ dashboard_admin_user | quote }}
  register: dashboard_admin_user_exist
  retries: 6
  delay: 5
  run_once: true
  failed_when: false
  changed_when: false
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: dashboard_admin_user_exist.rc == 0

- name: update dashboard admin password
  command: timeout --foreground -s KILL 10 {{ ceph_cmd }} --cluster {{ cluster }} dashboard ac-user-set-password -i - {{ dashboard_admin_user | quote }}  # noqa 304
  args:
    stdin: "{{ dashboard_admin_password }}"
    stdin_add_newline: no
  register: update_dashboard_admin_user
  retries: 6
  delay: 5
  run_once: true
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: update_dashboard_admin_user.rc == 0
  when:
    - dashboard_admin_user_exist.rc == 0
    - dashboard_password_from_stdin | bool

- name: update dashboard admin password (legacy)
  command: timeout --foreground -s KILL 10 {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-set-password {{ dashboard_admin_user | quote }} {{ dashboard_admin_password | quote }}  # noqa 304
  register: update_dashboard_admin_user
  retries: 6
  delay: 5
  run_once: true
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: update_dashboard_admin_user.rc == 0
  when:
    - dashboard_admin_user_exist.rc == 0
    - not dashboard_password_from_stdin | bool

- name: create dashboard admin user
  command: timeout --foreground -s KILL 10 {{ ceph_cmd }} --cluster {{ cluster }} dashboard ac-user-create -i - {{ dashboard_admin_user | quote }}  # noqa 304
  args:
    stdin: "{{ dashboard_admin_password }}"
    stdin_add_newline: no
  register: create_dashboard_admin_user
  retries: 6
  delay: 5
  run_once: true
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: create_dashboard_admin_user.rc == 0
  when:
    - dashboard_admin_user_exist.rc != 0
    - dashboard_password_from_stdin | bool

- name: create dashboard admin user (legacy)
  command: timeout --foreground -s KILL 10 {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-create {{ dashboard_admin_user | quote }} {{ dashboard_admin_password | quote }}
  register: create_dashboard_admin_user
  retries: 6
  delay: 5
  run_once: true
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: create_dashboard_admin_user.rc == 0
  when:
    - dashboard_admin_user_exist.rc != 0
    - not dashboard_password_from_stdin | bool

- name: set dashboard admin user role
  command: timeout --foreground -s KILL 10 {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-set-roles {{ dashboard_admin_user | quote }} {{ 'read-only' if dashboard_admin_user_ro | bool else 'administrator' }}
  register: dashboard_admin_user_role
  retries: 6
  delay: 5
  run_once: true
  changed_when: false
  delegate_to: "{{ groups[mon_group_name][0] }}"
  until: dashboard_admin_user_role.rc == 0

- name: set grafana api user
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-username {{ grafana_admin_user }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false

- name: set grafana api password
  command: "{{ ceph_cmd }} --cluster {{ cluster }} dashboard set-grafana-api-password -i -"  # noqa 304
  args:
    stdin: "{{ grafana_admin_password }}"
    stdin_add_newline: no
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false
  when: dashboard_password_from_stdin | bool

- name: set grafana api password (legacy)
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-password {{ grafana_admin_password }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false
  when: not dashboard_password_from_stdin | bool

- name: disable ssl verification for grafana
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-ssl-verify False"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false
  when:
    - dashboard_protocol == "https"
    - dashboard_grafana_api_no_ssl_verify | bool

- name: set alertmanager host
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-alertmanager-api-host http://{{ grafana_server_addrs | first }}:{{ alertmanager_port }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false

- name: set prometheus host
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-prometheus-api-host http://{{ grafana_server_addrs | first }}:{{ prometheus_port }}"
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true
  changed_when: false

- include_tasks: configure_grafana_layouts.yml
  with_items: '{{ grafana_server_addrs }}'
  vars:
    grafana_server_addr: '{{ item }}'

- name: config monitoring api url vip
  run_once: true
  block:
    - name: config grafana api url vip
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-url {{ dashboard_protocol }}://{{ dashboard_frontend_vip }}:{{ grafana_port }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      changed_when: false
      when: dashboard_frontend_vip is defined and dashboard_frontend_vip | length > 0

    - name: config alertmanager api url
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-alertmanager-api-host {{ dashboard_protocol }}://{{ alertmanager_frontend_vip }}:{{ alertmanager_port }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      changed_when: false
      when: alertmanager_frontend_vip is defined and alertmanager_frontend_vip | length > 0

    - name: config prometheus api url
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-prometheus-api-host {{ dashboard_protocol }}://{{ prometheus_frontend_vip }}:{{ prometheus_port }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      changed_when: false
      when: prometheus_frontend_vip is defined and prometheus_frontend_vip | length > 0

- name: dashboard object gateway management frontend
  when: groups.get(rgw_group_name, []) | length > 0
  block:
    - name: get radosgw system user
      command: "timeout --foreground -s KILL 20 {{ container_exec_cmd }} radosgw-admin --cluster {{ cluster }} user info --uid={{ dashboard_rgw_api_user_id }}"
      register: get_rgw_user
      until: get_rgw_user.rc == 0
      retries: 3
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      failed_when: false
      changed_when: false

    - name: create radosgw system user
      command: "timeout --foreground -s KILL 20 {{ container_exec_cmd }} radosgw-admin --cluster {{ cluster }} user create --uid={{ dashboard_rgw_api_user_id }} --display-name='Ceph dashboard' --system"
      register: create_rgw_user
      until: create_rgw_user.rc == 0
      retries: 3
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      when:
        - not rgw_multisite | bool or (true in (rgw_instances | selectattr('rgw_zonemaster', 'defined') | map(attribute='rgw_zonemaster') | list) if rgw_instances is defined else rgw_zonemaster | default(false))
        - get_rgw_user.rc == 22

    - name: get the rgw access and secret keys
      set_fact:
        rgw_access_key: "{{ (create_rgw_user.stdout | default(get_rgw_user.stdout) | from_json)['keys'][0]['access_key'] }}"
        rgw_secret_key: "{{ (create_rgw_user.stdout | default(get_rgw_user.stdout) | from_json)['keys'][0]['secret_key'] }}"
      run_once: true

    - name: set the rgw user
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-user-id {{ dashboard_rgw_api_user_id }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      changed_when: false

    - name: set the rgw access key
      command: "{{ ceph_cmd }} --cluster {{ cluster }} dashboard set-rgw-api-access-key -i -"  # noqa 304
      args:
        stdin: "{{ rgw_access_key }}"
        stdin_add_newline: no
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      changed_when: false
      when: dashboard_password_from_stdin | bool

    - name: set the rgw access key (legacy)
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-access-key {{ rgw_access_key }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      changed_when: false
      when: not dashboard_password_from_stdin | bool

    - name: set the rgw secret key
      command: "{{ ceph_cmd }} --cluster {{ cluster }} dashboard set-rgw-api-secret-key -i -"  # noqa 304
      args:
        stdin: "{{ rgw_secret_key }}"
        stdin_add_newline: no
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      changed_when: false
      when: dashboard_password_from_stdin | bool

    - name: set the rgw secret key (legacy)
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-secret-key {{ rgw_secret_key }}"
      delegate_to: "{{ groups[mon_group_name][0] }}"
      changed_when: false
      when: not dashboard_password_from_stdin | bool

    - name: set the rgw host
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-host {{ hostvars[groups[rgw_group_name][0]]['rgw_instances'][0]['radosgw_address'] }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

    - name: set the rgw port
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-port {{ hostvars[groups[rgw_group_name][0]]['rgw_instances'][0]['radosgw_frontend_port'] }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

    - name: set the rgw scheme
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-scheme {{ 'https' if radosgw_frontend_ssl_certificate else 'http' }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true

    - name: set the rgw admin resource
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-admin-resource {{ dashboard_rgw_api_admin_resource }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      when: dashboard_rgw_api_admin_resource | length > 0

    - name: disable ssl verification for rgw
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-ssl-verify False"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      when:
        - dashboard_rgw_api_no_ssl_verify | bool
        - radosgw_frontend_ssl_certificate | length > 0

- name: dashboard iscsi management
  when: groups.get(iscsi_gw_group_name, []) | length > 0
  block:
    - name: disable iscsi api ssl verification
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-iscsi-api-ssl-verification false"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      run_once: true
      when:
        - api_secure | default(false) | bool
        - generate_crt | default(false) | bool

    - name: add iscsi gateways - ipv4
      command: "{{ ceph_cmd }} --cluster {{ cluster }} dashboard iscsi-gateway-add -i -"  # noqa 304
      args:
        stdin: "{{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_facts']['all_ipv4_addresses'] | ips_in_ranges(igw_network.split(',')) | first }}:{{ hostvars[item]['api_port'] | default(5000) }}"
        stdin_add_newline: no
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      with_items: "{{ groups[iscsi_gw_group_name] }}"
      run_once: true
      when:
        - ip_version == 'ipv4'
        - dashboard_password_from_stdin | bool

    - name: add iscsi gateways - ipv4 (legacy)
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-add {{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_facts']['all_ipv4_addresses'] | ips_in_ranges(public_network.split(',')) | first }}:{{ hostvars[item]['api_port'] | default(5000) }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      with_items: "{{ groups[iscsi_gw_group_name] }}"
      run_once: true
      when:
        - ip_version == 'ipv4'
        - not dashboard_password_from_stdin | bool

    - name: add iscsi gateways - ipv6
      command: "{{ ceph_cmd }} --cluster {{ cluster }} dashboard iscsi-gateway-add -i -"  # noqa 304
      args:
        stdin: "{{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_facts']['all_ipv6_addresses'] | ips_in_ranges(igw_network.split(',')) | last | ipwrap }}:{{ hostvars[item]['api_port'] | default(5000) }}"
        stdin_add_newline: no
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      with_items: "{{ groups[iscsi_gw_group_name] }}"
      run_once: true
      when:
        - ip_version == 'ipv6'
        - dashboard_password_from_stdin | bool

    - name: add iscsi gateways - ipv6 (legacy)
      command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-add {{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_facts']['all_ipv6_addresses'] | ips_in_ranges(public_network.split(',')) | last | ipwrap }}:{{ hostvars[item]['api_port'] | default(5000) }}"
      changed_when: false
      delegate_to: "{{ groups[mon_group_name][0] }}"
      with_items: "{{ groups[iscsi_gw_group_name] }}"
      run_once: true
      when:
        - ip_version == 'ipv6'
        - not dashboard_password_from_stdin | bool

- name: disable mgr dashboard module (restart)
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module disable dashboard"
  changed_when: false
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true

- name: enable mgr dashboard module (restart)
  command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module enable dashboard"
  changed_when: false
  delegate_to: "{{ groups[mon_group_name][0] }}"
  run_once: true