ceph
/
ceph-ansible
mirror of https://github.com/ceph/ceph-ansible.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph-ansible/roles/ceph-common/tasks/checks/check_firewall.yml

103 lines
3.2 KiB
YAML
Raw Normal View History

Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
---
- name: check if nmap is installed
Fix firewall check Use command module instead of shell since we do not do anything fancy here. Remove the duplicate register. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-10 23:52:37 +08:00
command: "command -v nmap"
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: nmapexist
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
when: check_firewall
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
- name: inform that nmap is not present
debug:
msg: "nmap is not installed, can not test if ceph ports are allowed :("
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- nmapexist.rc != 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if monitor port is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6789 {{ item }} {{ hostvars[item]['ansible_' + monitor_interface]['ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ mon_group_name }}
register: monportstate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- mon_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if monitor port is filtered
fail:
msg: "Please allow port 6789 on your firewall"
with_items: monportstate.results
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- item.has_key('rc') and item.rc == 0
- mon_group_name is defined
- mon_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if osd and mds range is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ osd_group_name }}
register: osdrangestate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- osd_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (osd hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
with_items: osdrangestate.results
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- item.has_key('rc') and item.rc == 0
- osd_group_name is defined
- osd_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if osd and mds range is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ mds_group_name }}
register: mdsrangestate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- mds_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (mds hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
with_items: mdsrangestate.results
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- item.has_key('rc') and item.rc == 0
- mds_group_name is defined
- mds_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if rados gateway port is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p {{ radosgw_civetweb_port }} {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
ceph-common: use variable rgw_group_name instead of hard coded group name 'rgws' when checking rgw port. Signed-off-by: runsisi <runsisi@hust.edu.cn>
2016-03-28 18:59:09 +08:00
with_items: groups.{{ rgw_group_name }}
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
register: rgwportstate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- rgw_group_name in group_names
- nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if rados gateway port is filtered
fail:
msg: "Please allow port {{ radosgw_civetweb_port }} on your firewall"
with_items: rgwportstate.results
when:
Unify formatting of when conditional This is purely a refactor. Converts when 'and' conditionals into lists rather than multiline strings. This does not work for nested conditionals, but those can be formated with indents. Moves one line when statements onto the same line as the when command itself. A small logic bug was found in ceph-osd/tasks/check_devices.yml which which was also fixed. Signed-off-by: Sam Yaple <sam@yaple.net>
2016-05-09 22:08:33 +08:00
- check_firewall
- item.has_key('rc') and item.rc == 0
- rgw_group_name is defined
- rgw_group_name in group_names
- nmapexist.rc == 0