2014-09-05 03:14:11 +08:00
|
|
|
---
|
2015-07-17 00:42:12 +08:00
|
|
|
- name: generate monitor initial keyring
|
2016-09-19 08:37:31 +08:00
|
|
|
local_action: shell python2 -c "import os ; import struct ; import time; import base64 ; key = os.urandom(16) ; header = struct.pack('<hiih',1,int(time.time()),0,len(key)) ; print base64.b64encode(header + key)" | tee {{ fetch_directory }}/monitor_keyring.conf
|
2015-08-27 18:42:01 +08:00
|
|
|
creates={{ fetch_directory }}/monitor_keyring.conf
|
2015-07-17 20:06:25 +08:00
|
|
|
register: monitor_keyring
|
2016-02-04 19:36:46 +08:00
|
|
|
become: false
|
2016-02-25 21:57:50 +08:00
|
|
|
when: cephx
|
2015-07-17 00:42:12 +08:00
|
|
|
|
|
|
|
- name: read monitor initial keyring if it already exists
|
2015-10-17 07:55:31 +08:00
|
|
|
local_action: command cat {{ fetch_directory }}/monitor_keyring.conf
|
2015-08-27 18:42:01 +08:00
|
|
|
removes={{ fetch_directory }}/monitor_keyring.conf
|
2015-07-17 00:42:12 +08:00
|
|
|
changed_when: false
|
2015-07-17 20:06:25 +08:00
|
|
|
register: monitor_keyring
|
2016-02-04 19:36:46 +08:00
|
|
|
become: false
|
2016-11-24 18:54:10 +08:00
|
|
|
always_run: true
|
2016-02-25 21:57:50 +08:00
|
|
|
when: cephx
|
2015-07-17 00:42:12 +08:00
|
|
|
|
2015-05-16 00:27:41 +08:00
|
|
|
- name: create monitor initial keyring
|
2016-03-03 18:03:03 +08:00
|
|
|
command: ceph-authtool /var/lib/ceph/tmp/keyring.mon.{{ monitor_name }} --create-keyring --name=mon. --add-key={{ monitor_secret }} --cap mon 'allow *'
|
2015-10-17 07:55:31 +08:00
|
|
|
args:
|
2016-03-03 18:03:03 +08:00
|
|
|
creates: /var/lib/ceph/tmp/keyring.mon.{{ monitor_name }}
|
2016-02-25 21:57:50 +08:00
|
|
|
when: cephx
|
2014-09-05 03:14:11 +08:00
|
|
|
|
2016-02-02 22:10:24 +08:00
|
|
|
- name: set initial monitor key permissions
|
2015-11-17 23:10:02 +08:00
|
|
|
file:
|
2016-03-03 18:03:03 +08:00
|
|
|
path: /var/lib/ceph/tmp/keyring.mon.{{ monitor_name }}
|
2017-01-20 17:14:35 +08:00
|
|
|
owner: "ceph"
|
|
|
|
group: "ceph"
|
|
|
|
mode: "0600"
|
2016-02-25 21:57:50 +08:00
|
|
|
when: cephx
|
2015-11-17 23:10:02 +08:00
|
|
|
|
2017-06-30 16:17:23 +08:00
|
|
|
- name: create (and fix ownership of) monitor directory
|
2015-11-17 23:10:02 +08:00
|
|
|
file:
|
2016-03-29 21:37:31 +08:00
|
|
|
path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
|
2015-11-17 23:10:02 +08:00
|
|
|
state: directory
|
2017-01-20 17:14:35 +08:00
|
|
|
owner: "ceph"
|
|
|
|
group: "ceph"
|
|
|
|
mode: "0755"
|
2017-06-30 16:17:23 +08:00
|
|
|
recurse: true
|
2015-11-17 23:10:02 +08:00
|
|
|
|
2017-07-24 22:00:06 +08:00
|
|
|
- set_fact:
|
|
|
|
ceph_authtool_cap: "--cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow' --cap mgr 'allow *'"
|
|
|
|
when:
|
|
|
|
- ceph_release_num.{{ ceph_release }} >= ceph_release_num.luminous
|
|
|
|
- cephx
|
|
|
|
- admin_secret != 'admin_secret'
|
|
|
|
|
|
|
|
- set_fact:
|
|
|
|
ceph_authtool_cap: "--cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow'"
|
|
|
|
when:
|
|
|
|
- ceph_release_num.{{ ceph_release }} < ceph_release_num.luminous
|
|
|
|
- cephx
|
|
|
|
- admin_secret != 'admin_secret'
|
|
|
|
|
2017-07-05 17:07:00 +08:00
|
|
|
- name: create custom admin keyring
|
2017-07-24 22:00:06 +08:00
|
|
|
command: "ceph-authtool /etc/ceph/{{ cluster }}.client.admin.keyring --create-keyring --name=client.admin --add-key={{ admin_secret }} --set-uid=0 {{ ceph_authtool_cap }}"
|
2017-07-05 17:07:00 +08:00
|
|
|
args:
|
|
|
|
creates: /etc/ceph/{{ cluster }}.client.admin.keyring
|
|
|
|
register: create_custom_admin_secret
|
|
|
|
when:
|
|
|
|
- cephx
|
|
|
|
- admin_secret != 'admin_secret'
|
|
|
|
|
|
|
|
- name: set ownership of admin keyring
|
|
|
|
file:
|
|
|
|
path: /etc/ceph/{{ cluster }}.client.admin.keyring
|
|
|
|
state: file
|
|
|
|
owner: 'ceph'
|
|
|
|
group: 'ceph'
|
|
|
|
mode: '0600'
|
|
|
|
when:
|
|
|
|
- cephx
|
|
|
|
- admin_secret != 'admin_secret'
|
|
|
|
|
|
|
|
- name: import admin keyring into mon keyring
|
|
|
|
command: ceph-authtool /var/lib/ceph/tmp/keyring.mon.{{ monitor_name }} --import-keyring /etc/ceph/{{ cluster }}.client.admin.keyring
|
|
|
|
when:
|
|
|
|
- cephx
|
|
|
|
- admin_secret != 'admin_secret'
|
|
|
|
- not create_custom_admin_secret.get('skipped')
|
|
|
|
|
2017-01-20 17:14:35 +08:00
|
|
|
- name: ceph monitor mkfs with keyring
|
2016-03-29 21:37:31 +08:00
|
|
|
command: ceph-mon --cluster {{ cluster }} --setuser ceph --setgroup ceph --mkfs -i {{ monitor_name }} --fsid {{ fsid }} --keyring /var/lib/ceph/tmp/keyring.mon.{{ monitor_name }}
|
2015-11-17 23:10:02 +08:00
|
|
|
args:
|
2016-03-29 21:37:31 +08:00
|
|
|
creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/keyring
|
2016-02-25 21:57:50 +08:00
|
|
|
when:
|
2016-05-09 22:08:33 +08:00
|
|
|
- cephx
|
2014-09-05 03:14:11 +08:00
|
|
|
|
2017-01-20 17:14:35 +08:00
|
|
|
- name: ceph monitor mkfs without keyring
|
2016-06-06 22:22:20 +08:00
|
|
|
command: ceph-mon --cluster {{ cluster }} --setuser ceph --setgroup ceph --mkfs -i {{ monitor_name }} --fsid {{ fsid }}
|
2016-02-25 21:57:50 +08:00
|
|
|
args:
|
2016-03-29 21:37:31 +08:00
|
|
|
creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/store.db
|
2016-02-25 21:57:50 +08:00
|
|
|
when:
|
2016-05-09 22:08:33 +08:00
|
|
|
- not cephx
|