---
- name: Create bootstrap-mds and mds directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    mode: "{{ ceph_directories_mode }}"
  with_items:
    - /var/lib/ceph/bootstrap-mds/
    - /var/lib/ceph/mds/{{ cluster }}-{{ ansible_facts['hostname'] }}

- name: Get keys from monitors
  ceph_key:
    name: "{{ item.name }}"
    cluster: "{{ cluster }}"
    output_format: plain
    state: info
  environment:
    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
  register: _mds_keys
  with_items:
    - { name: "client.bootstrap-mds", path: "/var/lib/ceph/bootstrap-mds/{{ cluster }}.keyring", copy_key: true }
    - { name: "client.admin", path: "/etc/ceph/{{ cluster }}.client.admin.keyring", copy_key: "{{ copy_admin_key }}" }
  delegate_to: "{{ groups.get(mon_group_name)[0] }}"
  run_once: true
  when:
    - cephx | bool
    - item.copy_key | bool
  no_log: "{{ no_log_on_ceph_key_tasks }}"

- name: Copy ceph key(s) if needed
  ansible.builtin.copy:
    dest: "{{ item.item.path }}"
    content: "{{ item.stdout + '\n' }}"
    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    mode: "{{ ceph_keyring_permissions }}"
  with_items: "{{ _mds_keys.results }}"
  when:
    - cephx | bool
    - item.item.copy_key | bool
  no_log: "{{ no_log_on_ceph_key_tasks }}"

- name: Create mds keyring
  ceph_key:
    name: "mds.{{ ansible_facts['hostname'] }}"
    cluster: "{{ cluster }}"
    user: client.bootstrap-mds
    user_key: "/var/lib/ceph/bootstrap-mds/{{ cluster }}.keyring"
    caps:
      mon: "allow profile mds"
      mds: "allow"
      osd: "allow rwx"
    dest: "/var/lib/ceph/mds/{{ cluster }}-{{ ansible_facts['hostname'] }}/keyring"
    import_key: false
    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
    mode: "{{ ceph_keyring_permissions }}"
  no_log: "{{ no_log_on_ceph_key_tasks }}"
  environment:
    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
  when: cephx | bool