ceph-ansible/roles/ceph-mon/tasks/deploy_monitors.yml

202 lines
7.9 KiB
YAML

---
- name: Cephx related tasks
when: cephx | bool
block:
- name: Check if monitor initial keyring already exists
ceph_key:
name: mon.
cluster: "{{ cluster }}"
user: mon.
user_key: "/var/lib/ceph/mon/{{ cluster }}-{{ hostvars[running_mon]['ansible_facts']['hostname'] }}/keyring"
output_format: json
state: info
environment:
CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
CEPH_CONTAINER_BINARY: "{{ container_binary }}"
register: initial_mon_key
run_once: true
delegate_to: "{{ running_mon }}"
failed_when: initial_mon_key.rc not in [0, 2]
no_log: "{{ no_log_on_ceph_key_tasks }}"
when: running_mon is defined
- name: Generate monitor initial keyring
ceph_key:
state: generate_secret
register: monitor_keyring
delegate_to: localhost
become: false
run_once: true
no_log: "{{ no_log_on_ceph_key_tasks }}"
when:
- initial_mon_key is skipped
or
initial_mon_key is not succeeded
- name: Set_fact _initial_mon_key_success
ansible.builtin.set_fact: # when initial_mon_key is registered above, `rc: 2` is considered success.
_initial_mon_key_success: "{{ initial_mon_key is not skipped and initial_mon_key.rc == 0 }}"
- name: Get initial keyring when it already exists
ansible.builtin.set_fact:
monitor_keyring: "{{ (initial_mon_key.stdout | from_json)[0]['key'] if _initial_mon_key_success | bool else monitor_keyring.stdout }}"
when: initial_mon_key.stdout|default('')|length > 0 or monitor_keyring is not skipped
no_log: "{{ no_log_on_ceph_key_tasks }}"
- name: Create monitor initial keyring
ceph_key:
name: mon.
dest: "/var/lib/ceph/tmp/"
secret: "{{ monitor_keyring }}"
cluster: "{{ cluster }}"
caps:
mon: allow *
import_key: false
owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
mode: "0400"
no_log: "{{ no_log_on_ceph_key_tasks }}"
environment:
CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
CEPH_CONTAINER_BINARY: "{{ container_binary }}"
- name: Copy the initial key in /etc/ceph (for containers)
ansible.builtin.copy:
src: /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
dest: /etc/ceph/{{ cluster }}.mon.keyring
remote_src: true
mode: "0640"
when: containerized_deployment | bool
- name: Create monitor directory
ansible.builtin.file:
path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
state: directory
owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
mode: "{{ ceph_directories_mode }}"
# We don't do the recursion in the task above to avoid setting `mode` (which
# defaults to 0755) on files.
#
# This is only needed when upgrading from older versions of Ceph that used to
# run as `root` (https://github.com/ceph/ceph-ansible/issues/1635).
- name: Recursively fix ownership of monitor directory
ansible.builtin.file:
path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
state: directory
owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
recurse: true
- name: Create admin keyring
ceph_authtool:
name: client.admin
path: "/etc/ceph/{{ cluster }}.client.admin.keyring"
owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
mode: "0400"
caps:
mon: allow *
mgr: allow *
osd: allow *
mds: allow *
create_keyring: true
gen_key: "{{ True if admin_secret == 'admin_secret' else omit }}"
add_key: "{{ admin_secret if admin_secret != 'admin_secret' else omit }}"
delegate_to: "{{ groups[mon_group_name][0] }}"
run_once: true
environment:
CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
CEPH_CONTAINER_BINARY: "{{ container_binary }}"
no_log: "{{ no_log_on_ceph_key_tasks }}"
when:
- cephx | bool
- name: Slurp admin keyring
ansible.builtin.slurp:
src: "/etc/ceph/{{ cluster }}.client.admin.keyring"
delegate_to: "{{ groups[mon_group_name][0] }}"
run_once: true
register: admin_keyring
- name: Copy admin keyring over to mons
ansible.builtin.copy:
dest: "{{ admin_keyring.source }}"
content: "{{ admin_keyring.content | b64decode }}"
owner: "{{ ceph_uid }}"
group: "{{ ceph_uid }}"
mode: "0600"
delegate_to: "{{ item }}"
loop: "{{ groups[mon_group_name] }}"
no_log: "{{ no_log_on_ceph_key_tasks }}"
- name: Import admin keyring into mon keyring
ceph_authtool:
path: "/var/lib/ceph/tmp/{{ cluster }}.mon..keyring"
owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
mode: "0400"
import_keyring: "/etc/ceph/{{ cluster }}.client.admin.keyring"
environment:
CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
CEPH_CONTAINER_BINARY: "{{ container_binary }}"
no_log: "{{ no_log_on_ceph_key_tasks }}"
when:
- cephx | bool
- name: Set_fact ceph-mon container command
ansible.builtin.set_fact:
ceph_mon_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=ceph-mon ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'ceph-mon' }}"
- name: Set_fact monmaptool container command
ansible.builtin.set_fact:
ceph_monmaptool_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=monmaptool ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'monmaptool' }}"
- name: Generate initial monmap
ansible.builtin.command: >
{{ ceph_monmaptool_cmd }}
--create
{% for name, addr in _monitor_addresses.items() -%}
--addv
{{ hostvars[name]['ansible_facts']['hostname'] }}
{% if mon_host_v1.enabled | bool %}
{% set _v1 = ',v1:' + addr + mon_host_v1.suffix %}
{% endif %}
[{{ "v2:" + addr + mon_host_v2.suffix }}{{ _v1 | default('') }}]
{# {%- if not loop.last -%},{%- endif %} #}
{%- endfor %}
--enable-all-features
--clobber /etc/ceph/monmap
args:
creates: /etc/ceph/monmap
- name: Ceph monitor mkfs with keyring
ansible.builtin.command: >
{{ ceph_mon_cmd }}
--cluster {{ cluster }}
--setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
--setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
--mkfs
-i {{ monitor_name }}
--fsid {{ fsid }}
--keyring /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
--monmap /etc/ceph/monmap
args:
creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/keyring
when: cephx | bool
- name: Ceph monitor mkfs without keyring
ansible.builtin.command: >
{{ ceph_mon_cmd }}
--cluster {{ cluster }}
--setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
--setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
--mkfs
-i {{ monitor_name }}
--fsid {{ fsid }}
args:
creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/store.db
when: not cephx | bool