ceph-ansible/roles/ceph-mon/tasks/ceph_keys.yml

---
# Wait for mon discovery and quorum resolution
# the admin key is not instantanely created so we have to wait a bit

- name: wait for client.admin key exists
  wait_for: path=/etc/ceph/ceph.client.admin.keyring

- name: Create RGW keyring
  command: >
    ceph auth get-or-create client.radosgw.{{ hostvars[item]['ansible_hostname'] }} osd 'allow rwx' mon 'allow rw' -o /etc/ceph/ceph.client.radosgw.{{ hostvars[item]['ansible_hostname'] }}.keyring
    creates=/etc/ceph/ceph.client.radosgw.{{ hostvars[item]['ansible_hostname'] }}.keyring
  when: cephx and radosgw
  with_items: groups.rgws
  changed_when: False

- name: Create Ceph REST API keyring
  command: >
    ceph auth get-or-create client.restapi osd 'allow *' mon 'allow *' -o /etc/ceph/ceph.client.restapi.keyring
    creates=/etc/ceph/ceph.client.restapi.keyring
  when: cephx and restapi
  changed_when: False

- include: openstack_config.yml
  when: openstack_config and cephx

- name: Find Ceph keys
  shell: ls -1 /etc/ceph/*.keyring
  register: ceph_keys
  when: cephx
  changed_when: False

- name: Set keys permissions
  file: >
    path={{ item }}
    mode=0600
    owner=root
    group=root
  with_items:
    - "{{ ceph_keys.stdout_lines }}"

- name: Copy keys to the ansible server
  fetch: >
    src={{ item }}
    dest=fetch/{{ fsid }}/{{ item }}
    flat=yes
  when: cephx
  with_items:
    - "{{ ceph_keys.stdout_lines }}"
    - /var/lib/ceph/bootstrap-osd/ceph.keyring
    - /var/lib/ceph/bootstrap-mds/ceph.keyring

- name: Drop in a motd script to report status when logging in
  copy: >
    src=precise/92-ceph
    dest=/etc/update-motd.d/92-ceph
    owner=root
    group=root
    mode=0755
  when: ansible_distribution_release == 'precise'