ceph
/
ceph-ansible
mirror of https://github.com/ceph/ceph-ansible.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph-ansible/roles/ceph-mon/tasks/secure_cluster.yml

14 lines
481 B
YAML
Raw Normal View History

Ability to secure cluster pools We set several flags to keep the cluster secure: * nodelete * nopgchange * nosizechange Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
2015-05-12 17:18:12 +08:00
---
Re-arrange roles Trying to add more clarity in the role's task structure. Signed-off-by: leseb <seb@redhat.com>
2015-07-24 02:01:43 +08:00
- name: collect all the pools
ceph: implement cluster name support we now have the ability to enable the `cluster` variable with a specific value that will determine the name of the cluster. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-03-29 21:37:31 +08:00
command: rados --cluster {{ cluster }} lspools
Ability to secure cluster pools We set several flags to keep the cluster secure: * nodelete * nopgchange * nosizechange Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
2015-05-12 17:18:12 +08:00
register: ceph_pools
Better --check compatibility for ceph-mon role Carefully chosen "always_run: true" parameters for read-only tasks that register variables. This enables --check runs (at least on deployed clusters).
2016-11-27 04:05:32 +08:00
always_run: true
secure_cluster: fix leftover version check Missed by #953. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2016-10-04 23:12:15 +08:00
when: ceph_release_num.{{ ceph_release }} >= ceph_release_num.hammer
Ability to secure cluster pools We set several flags to keep the cluster secure: * nodelete * nopgchange * nosizechange Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
2015-05-12 17:18:12 +08:00
- name: secure the cluster
ceph: implement cluster name support we now have the ability to enable the `cluster` variable with a specific value that will determine the name of the cluster. Signed-off-by: Sébastien Han <seb@redhat.com>
2016-03-29 21:37:31 +08:00
command: ceph --cluster {{ cluster }} osd pool set {{ item[0] }} {{ item[1] }} true
Ability to secure cluster pools We set several flags to keep the cluster secure: * nodelete * nopgchange * nosizechange Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
2015-05-12 17:18:12 +08:00
with_nested:
ceph-mon: fix the loop in `secure the cluster' task Deployment fails when the ``secure_cluster`` is false: TASK [ceph-mon : secure the cluster] ******************************************* fatal: [saceph-mon.vm.ceph.asheplyakov]: FAILED! => {"failed": true, "msg": "'dict object' has no attribute 'stdout_lines'"} fatal: [saceph-mon2.vm.ceph.asheplyakov]: FAILED! => {"failed": true, "msg": "'dict object' has no attribute 'stdout_lines'"} fatal: [saceph-mon3.vm.ceph.asheplyakov]: FAILED! => {"failed": true, "msg": "'dict object' has no attribute 'stdout_lines'"} A conditional include evaluates all included tasks with the (additional) conditional applied to every task [1]. Thus all tasks from `secure_cluster.yml' are always evaluated (with an additional 'when: secure_cluster' condition). The `secure the cluster' task iterates over ``ceph_pools.stdout_lines`` even if ``secure_cluster`` is false: in loops ansible applies conditional to every item (by design) [2]. However the `collect all the pools' task is skipped if the very same condition evaluates to false, which leaves the ``ceph_pools`` undefined, so the `secure the cluster' task fails: Provide the default (empty) list to avoid the problem. [1] http://docs.ansible.com/ansible/playbooks_conditionals.html#applying-when-to-roles-and-includes [2] http://docs.ansible.com/ansible/playbooks_conditionals.html#loops-and-conditionals Closes: #913 Signed-off-by: Alexey Sheplyakov <asheplyakov@mirantis.com>
2016-07-29 18:30:21 +08:00
- "{{ ceph_pools.stdout_lines|default([]) }}"
moving to ansible v2.2 compatibility Signed-off-by: Sébastien Han <seb@redhat.com> Co-Authored-By: Julien Francoz julien@francoz.net
2016-11-03 17:16:33 +08:00
- "{{ secure_cluster_flags }}"
Updated release version check
2016-09-30 23:43:53 +08:00
when: ceph_release_num.{{ ceph_release }} >= ceph_release_num.hammer