ceph
/
ceph-ansible
mirror of https://github.com/ceph/ceph-ansible.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph-ansible/roles/ceph-common/tasks/checks/check_firewall.yml

103 lines
3.1 KiB
YAML
Raw Normal View History

Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
---
- name: check if nmap is installed
Fix firewall check Use command module instead of shell since we do not do anything fancy here. Remove the duplicate register. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-10 23:52:37 +08:00
command: "command -v nmap"
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
register: nmapexist
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
when: check_firewall
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
- name: inform that nmap is not present
debug:
msg: "nmap is not installed, can not test if ceph ports are allowed :("
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
when:
check_firewall and
nmapexist.rc != 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if monitor port is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6789 {{ item }} {{ hostvars[item]['ansible_' + monitor_interface]['ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ mon_group_name }}
register: monportstate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
mon_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if monitor port is filtered
fail:
msg: "Please allow port 6789 on your firewall"
with_items: monportstate.results
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
item.rc == 0 and
mon_group_name is defined and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
mon_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if osd and mds range is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ osd_group_name }}
register: osdrangestate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
osd_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (osd hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
with_items: osdrangestate.results
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
item.rc == 0 and
osd_group_name is defined and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
osd_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if osd and mds range is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p 6800-7300 {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.{{ mds_group_name }}
register: mdsrangestate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
mds_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if osd and mds range is filtered (mds hosts)
fail:
msg: "Please allow range from 6800 to 7300 on your firewall"
with_items: mdsrangestate.results
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
item.rc == 0 and
mds_group_name is defined and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
mds_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: check if rados gateway port is not filtered
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
local_action: shell set -o pipefail && nmap -p {{ radosgw_civetweb_port }} {{ item }} {{ hostvars[item]['ansible_default_ipv4']['address'] }} | grep -sqo filtered
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
changed_when: false
failed_when: false
with_items: groups.rgws
register: rgwportstate
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
rgw_group_name in group_names and
nmapexist.rc == 0
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
- name: fail if rados gateway port is filtered
fail:
msg: "Please allow port {{ radosgw_civetweb_port }} on your firewall"
with_items: rgwportstate.results
when:
Improve firewall checks The firewall checks can fail for any number of reasons -- e.g., the ceph cluster hostnames are unresolvable from the ansible host, or the ports are filtered by some intermediate hop, etc. Make two changes to make those checks better: * Set pipefail when running the checks, so if nmap itself fails the command will be marked as 'failed'. Specifically, this fixes the case where the hostnames cannot be resolved. * Add a new variable, check_firewall, which can be used to disable checks entirely. Specifically, this fixes the case where some intermediate firewall filters the ports, so nmap returns "filtered".
2016-02-24 00:27:55 +08:00
check_firewall and
Check for blocked ports As raised in #466 it is important in order to avoid unnecessary troubleshooting to check that ceph ports are allowed on the platform. The check runs a nmap command from the host running Ansible to all the ceph nodes with their respective ports. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-08 23:36:31 +08:00
item.rc == 0 and
rgw_group_name is defined and
Do not make nmap mandatory We can not force people to have nmap installed so instead we raise a warning is not present. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-01-11 00:22:17 +08:00
rgw_group_name in group_names and
nmapexist.rc == 0