From b20519efd0b9af4f2467daa311b9dca6086d4f87 Mon Sep 17 00:00:00 2001 From: Dimitri Savineau Date: Tue, 28 Apr 2020 13:31:01 -0400 Subject: [PATCH] dashboard: allow disabling grafana api ssl verify When using an untrusted TLS certificate (like self-signed) on grafana then the grafana dashboards update subcommand will fail. One solution could be to trust the TLS certificate. The other one is to disable the TLS verification on the grafana API. Closes: #5324 Signed-off-by: Dimitri Savineau --- group_vars/all.yml.sample | 1 + group_vars/rhcs.yml.sample | 1 + roles/ceph-dashboard/tasks/configure_dashboard.yml | 9 +++++++++ roles/ceph-defaults/defaults/main.yml | 1 + 4 files changed, 12 insertions(+) diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample index 2459d3708..58c785724 100644 --- a/group_vars/all.yml.sample +++ b/group_vars/all.yml.sample @@ -749,6 +749,7 @@ dummy: # We only need this for SSL (https) connections #dashboard_crt: '' #dashboard_key: '' +#dashboard_grafana_api_no_ssl_verify: False #dashboard_rgw_api_user_id: ceph-dashboard #dashboard_rgw_api_admin_resource: '' #dashboard_rgw_api_no_ssl_verify: False diff --git a/group_vars/rhcs.yml.sample b/group_vars/rhcs.yml.sample index eebd0396c..6d89766d3 100644 --- a/group_vars/rhcs.yml.sample +++ b/group_vars/rhcs.yml.sample @@ -749,6 +749,7 @@ ceph_docker_registry_auth: true # We only need this for SSL (https) connections #dashboard_crt: '' #dashboard_key: '' +#dashboard_grafana_api_no_ssl_verify: False #dashboard_rgw_api_user_id: ceph-dashboard #dashboard_rgw_api_admin_resource: '' #dashboard_rgw_api_no_ssl_verify: False diff --git a/roles/ceph-dashboard/tasks/configure_dashboard.yml b/roles/ceph-dashboard/tasks/configure_dashboard.yml index a3b294990..718412b3b 100644 --- a/roles/ceph-dashboard/tasks/configure_dashboard.yml +++ b/roles/ceph-dashboard/tasks/configure_dashboard.yml @@ -107,6 +107,15 @@ run_once: true changed_when: false +- name: disable ssl verification for grafana + command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-ssl-verify False" + delegate_to: "{{ groups[mon_group_name][0] }}" + run_once: true + changed_when: false + when: + - dashboard_protocol == "https" + - dashboard_grafana_api_no_ssl_verify | bool + - name: set alertmanager host command: "{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-alertmanager-api-host http://{{ grafana_server_addrs | first }}:{{ alertmanager_port }}" delegate_to: "{{ groups[mon_group_name][0] }}" diff --git a/roles/ceph-defaults/defaults/main.yml b/roles/ceph-defaults/defaults/main.yml index 0c161b468..4db0b65d6 100644 --- a/roles/ceph-defaults/defaults/main.yml +++ b/roles/ceph-defaults/defaults/main.yml @@ -741,6 +741,7 @@ dashboard_admin_user_ro: false # We only need this for SSL (https) connections dashboard_crt: '' dashboard_key: '' +dashboard_grafana_api_no_ssl_verify: False dashboard_rgw_api_user_id: ceph-dashboard dashboard_rgw_api_admin_resource: '' dashboard_rgw_api_no_ssl_verify: False