ceph
/
ceph-ansible
mirror of https://github.com/ceph/ceph-ansible.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph-ansible/roles/ceph-common/tasks/checks/check_firewall.yml

106 lines
3.4 KiB
YAML
Raw Normal View History

Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
---
- name: check if nmap is installed
fix check nmapexist on debian command is a shell-buitin, so `command -v nmap` must use shell module Signed-off-by: Shengjing Zhu <zsj950618@gmail.com>
2016-12-28 16:21:23 +08:00
local_action: shell command -v nmap
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: nmapexist
Fix for nmap arguments and grep matching, as well as only running local_actions once
2016-06-07 19:48:07 +08:00
run_once: true
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
- name: inform that nmap is not present
debug:
msg: "nmap is not installed, can not test if ceph ports are allowed :("
Fix for nmap arguments and grep matching, as well as only running local_actions once
2016-06-07 19:48:07 +08:00
run_once: true
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- nmapexist.rc != 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if monitor port is not filtered
Fix typo for ceph monitor port
2016-06-07 22:50:43 +08:00
local_action: shell set -o pipefail && nmap -p 6789 {{ hostvars[inventory_hostname]['ansible_' + monitor_interface]['ipv4']['address'] if hostvars[inventory_hostname]['ansible_' + monitor_interface] is defined else hostvars[inventory_hostname]['monitor_address'] }} | grep -sqo -e filtered -e '0 hosts up'
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: monportstate
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- mon_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if monitor port is filtered
fail:
msg: "Please allow port 6789 on your firewall"
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- mon_group_name in group_names
- nmapexist.rc == 0
Only check ports if NMAP exists Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-06-22 22:10:16 +08:00
- monportstate.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
Various fixes for check_firewall task: - Check for nmap being available was not running as a local_action, when the checks using nmap were - Various fixes on Ansible 2.x now that the above is working
2016-06-04 15:03:22 +08:00
- name: check if osd and mds range is not filtered (osd hosts)
Clean up checks and with_item loops that are no longer needed due to other fixes in this PR
2016-06-07 22:27:07 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }} | grep -sqo -e filtered -e '0 hosts up'
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: osdrangestate
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- osd_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (osd hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- osd_group_name in group_names
- nmapexist.rc == 0
Only check ports if NMAP exists Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-06-22 22:10:16 +08:00
- osdrangestate.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
Various fixes for check_firewall task: - Check for nmap being available was not running as a local_action, when the checks using nmap were - Various fixes on Ansible 2.x now that the above is working
2016-06-04 15:03:22 +08:00
- name: check if osd and mds range is not filtered (mds hosts)
Clean up checks and with_item loops that are no longer needed due to other fixes in this PR
2016-06-07 22:27:07 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }} | grep -sqo -e filtered -e '0 hosts up'
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: mdsrangestate
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- mds_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (mds hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- mds_group_name in group_names
- nmapexist.rc == 0
Only check ports if NMAP exists Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-06-22 22:10:16 +08:00
- mdsrangestate.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if rados gateway port is not filtered
Clean up checks and with_item loops that are no longer needed due to other fixes in this PR
2016-06-07 22:27:07 +08:00
local_action: shell set -o pipefail && nmap -p {{ radosgw_civetweb_port }} {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }} | grep -sqo -e filtered -e '0 hosts up'
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: rgwportstate
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- rgw_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if rados gateway port is filtered
fail:
msg: "Please allow port {{ radosgw_civetweb_port }} on your firewall"
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- rgw_group_name in group_names
- nmapexist.rc == 0
Only check ports if NMAP exists Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-06-22 22:10:16 +08:00
- rgwportstate.rc == 0
Add support for Ceph NFS Gateway Ceph has the ability to export it's filesystem via NFS using Ganesha. Add a ceph-nfs role that will start Ganesha and export the Ceph filesystems. Note that, although support is going in to export RGW via NFS, this is not working yet. Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-05-06 02:20:03 +08:00
- name: check if NFS ports are not filtered
local_action: shell set -o pipefail && nmap -p 111,2049 {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }} | grep -sqo -e filtered -e '0 hosts up'
changed_when: false
failed_when: false
register: nfsportstate
Better --check compatibility for ceph-common role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 03:39:12 +08:00
always_run: true
Add support for Ceph NFS Gateway Ceph has the ability to export it's filesystem via NFS using Ganesha. Add a ceph-nfs role that will start Ganesha and export the Ceph filesystems. Note that, although support is going in to export RGW via NFS, this is not working yet. Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-05-06 02:20:03 +08:00
when:
- nfs_group_name in group_names
- nmapexist.rc == 0
- name: fail if NFS ports are filtered
fail:
msg: "Please allow ports 111 and 2049 on your firewall"
when:
- nfs_group_name in group_names
- nmapexist.rc == 0
Only check ports if NMAP exists Signed-off-by: Daniel Gryniewicz <dang@redhat.com>
2016-06-22 22:10:16 +08:00
- nfsportstate.rc == 0