ceph-ansible/roles/ceph-mon/tasks/ceph_keys.yml

---
- name: waiting for the monitor(s) to form the quorum...
  command: "ceph --cluster {{ cluster }} -n mon. -k /var/lib/ceph/mon/{{ cluster }}-{{ ansible_hostname }}/keyring mon_status --format json"
  register: ceph_health_raw
  until: >
    (ceph_health_raw.stdout | from_json)['state'] in ['leader', 'peon']
  retries: "{{ handler_health_mon_check_retries }}"
  delay: "{{ handler_health_mon_check_delay }}"
  when:
    - ceph_release_num[ceph_release] >= ceph_release_num.nautilus

- name: fetch ceph keys in nautilus and above
  ceph_key:
    state: fetch_initial_keys
    cluster: "{{ cluster }}"
  when:
    - ceph_release_num[ceph_release] >= ceph_release_num.nautilus
    - cephx

- name: collect admin and bootstrap keys
  command: ceph-create-keys --cluster {{ cluster }} -i {{ monitor_name }} -t 30
  changed_when: false
  check_mode: no
  when:
    - ceph_release_num[ceph_release] < ceph_release_num.nautilus
    - cephx

# NOTE (leseb): wait for mon discovery and quorum resolution
# the admin key is not instantaneously created so we have to wait a bit
# msg: is only supported as of Ansible 2.4.
- name: "wait for {{ cluster }}.client.admin.keyring exists"
  wait_for:
    path: /etc/ceph/{{ cluster }}.client.admin.keyring
    timeout: 30
    msg: "Timed out while waiting for keyring creation. Check network settings on mon nodes."
  when:
    - ceph_release_num[ceph_release] < ceph_release_num.nautilus
    - cephx
    - (ansible_version.major == 2 and ansible_version.minor >= 4) or
      ansible_version.major > 2

- name: "wait for {{ cluster }}.client.admin.keyring exists"
  wait_for:
    path: /etc/ceph/{{ cluster }}.client.admin.keyring
    timeout: 30
  when:
    - ceph_release_num[ceph_release] < ceph_release_num.nautilus
    - cephx
    - ansible_version.major == 2 and ansible_version.minor < 4

- name: create ceph mgr keyring(s) when mon is not containerized
  ceph_key:
    name: "mgr.{{ hostvars[item]['ansible_hostname'] }}"
    state: present
    caps:
      mon: allow profile mgr
      osd: allow *
      mds: allow *
    cluster: "{{ cluster }}"
    secret: "{{ (mgr_secret != 'mgr_secret') | ternary(mgr_secret, omit) }}"
  when:
    - cephx
    - groups.get(mgr_group_name, []) | length > 0
    - inventory_hostname == groups[mon_group_name]|last
  with_items: "{{ groups.get(mgr_group_name, []) }}"

# once this gets backported github.com/ceph/ceph/pull/20983
# we will be able to remove these 2 tasks below
- name: find ceph keys
  shell: ls -1 /etc/ceph/*.keyring
  changed_when: false
  register: ceph_keys
  check_mode: no
  when:
    - cephx

- name: set keys permissions
  file:
    path: "{{ item }}"
    owner: "ceph"
    group: "ceph"
    mode: "{{ ceph_keyring_permissions }}"
  with_items:
    - "{{ ceph_keys.get('stdout_lines') | default([]) }}"
  when:
    - cephx

- name: copy keys to the ansible server
  fetch:
    src: "{{ item }}"
    dest: "{{ fetch_directory }}/{{ fsid }}/{{ item }}"
    flat: yes
  with_items:
    - "{{ ceph_keys.get('stdout_lines') | default([]) }}"
    - /var/lib/ceph/bootstrap-osd/{{ cluster }}.keyring
    - /var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring
    - /var/lib/ceph/bootstrap-mds/{{ cluster }}.keyring
    - /var/lib/ceph/bootstrap-rbd/{{ cluster }}.keyring
    - /var/lib/ceph/bootstrap-rbd-mirror/{{ cluster }}.keyring
  when:
    - cephx
    - inventory_hostname == groups[mon_group_name] | last