ceph-ansible/roles/ceph-mon/tasks/ceph_keys.yml

---
# NOTE (leseb): wait for mon discovery and quorum resolution
# the admin key is not instantanely created so we have to wait a bit
- name: wait for client.admin key exists
  wait_for:
    path: /etc/ceph/ceph.client.admin.keyring

- name: create ceph rest api keyring when mon is not containerized
  command: ceph auth get-or-create client.restapi osd 'allow *' mon 'allow *' -o /etc/ceph/ceph.client.restapi.keyring
  args:
    creates: /etc/ceph/ceph.client.restapi.keyring
  changed_when: false
  when:
    cephx and
    not mon_containerized_deployment and
    groups[restapi_group_name] is defined

- name: create ceph rest api keyring when mon is containerized
  command: docker exec {{ ansible_hostname }} ceph auth get-or-create client.restapi osd 'allow *' mon 'allow *' -o /etc/ceph/ceph.client.restapi.keyring
  args:
     creates: /etc/ceph/ceph.client.restapi.keyring
  changed_when: false
  when:
    cephx and
    mon_containerized_deployment and
    groups[restapi_group_name] is defined and
    inventory_hostname == groups.mons|last


- include: openstack_config.yml
  when: openstack_config

- name: find ceph keys
  shell: ls -1 /etc/ceph/*.keyring
  changed_when: false
  register: ceph_keys
  when: cephx

- name: set keys permissions
  file:
    path: "{{ item }}"
    mode: 0600
    owner: root
    group: root
  with_items:
    - "{{ ceph_keys.stdout_lines }}"
  when: cephx

- name: copy keys to the ansible server
  fetch:
    src: "{{ item }}"
    dest: "{{ fetch_directory }}/{{ fsid }}/{{ item }}"
    flat: yes
  run_once: true
  with_items:
    - "{{ ceph_keys.stdout_lines }}"
    - /var/lib/ceph/bootstrap-osd/ceph.keyring
    - /var/lib/ceph/bootstrap-rgw/ceph.keyring
    - /var/lib/ceph/bootstrap-mds/ceph.keyring
  when: cephx

- name: drop in a motd script to report status when logging in
  copy:
    src: precise/92-ceph
    dest: /etc/update-motd.d/92-ceph
    owner: root
    group: root
    mode: 0755
  when: ansible_distribution_release == 'precise'