ceph-ansible/roles/ceph-mon/tasks/ceph_keys.yml

126 lines
3.9 KiB
YAML

---
- name: collect admin and bootstrap keys
command: ceph-create-keys --cluster {{ cluster }} -i {{ monitor_name }}
args:
creates: /etc/ceph/{{ cluster }}.client.admin.keyring
failed_when: false
changed_when: false
always_run: true
when:
- cephx
# NOTE (leseb): wait for mon discovery and quorum resolution
# the admin key is not instantaneously created so we have to wait a bit
- name: "wait for {{ cluster }}.client.admin.keyring exists"
wait_for:
path: /etc/ceph/{{ cluster }}.client.admin.keyring
when: cephx
- name: test if initial mon keyring is in mon kv store
command: ceph --cluster {{ cluster }} config-key get initial_mon_keyring
changed_when: false
ignore_errors: true
always_run: true
run_once: true
failed_when: false
register: is_initial_mon_keyring_in_kv
- name: put initial mon keyring in mon kv store
command: ceph --cluster {{ cluster }} config-key put initial_mon_keyring {{ monitor_keyring.stdout }}
changed_when: false
always_run: true
run_once: true
when:
- is_initial_mon_keyring_in_kv.rc != 0
- cephx
- name: create ceph rest api keyring when mon is not containerized
command: ceph --cluster {{ cluster }} auth get-or-create client.restapi osd 'allow *' mon 'allow *' -o /etc/ceph/{{ cluster }}.client.restapi.keyring
args:
creates: /etc/ceph/{{ cluster }}.client.restapi.keyring
changed_when: false
when:
- cephx
- groups.get(restapi_group_name, []) | length > 0
- inventory_hostname == groups[mon_group_name]|last
- name: create ceph mgr keyring(s) when mon is not containerized
command: ceph --cluster {{ cluster }} auth get-or-create mgr.{{ hostvars[item]['ansible_hostname'] }} mon 'allow profile mgr' osd 'allow *' mds 'allow *' -o /etc/ceph/{{ cluster }}.mgr.{{ hostvars[item]['ansible_hostname'] }}.keyring
args:
creates: /etc/ceph/{{ cluster }}.mgr.{{ hostvars[item]['ansible_hostname'] }}.keyring
changed_when: false
when:
- cephx
- groups.get(mgr_group_name, []) | length > 0
- inventory_hostname == groups[mon_group_name]|last
- ceph_release_num.{{ ceph_release }} > ceph_release_num.jewel
with_items: "{{ groups.get(mgr_group_name, []) }}"
- include: set_osd_pool_default_pg_num.yml
- name: test if rbd exists
command: ceph --cluster {{ cluster }} osd pool get rbd size
changed_when: false
failed_when: false
register: rbd_pool_exist
- include: rbd_pool.yml
when: rbd_pool_exist.rc == 0
- include: rbd_pool_pgs.yml
when:
- rbd_pool_exist.rc == 0
- global_in_ceph_conf_overrides
- ceph_conf_overrides.global.osd_pool_default_pg_num is defined
- include: rbd_pool_size.yml
when:
- rbd_pool_exist.rc == 0
- global_in_ceph_conf_overrides
- ceph_conf_overrides.global.osd_pool_default_size is defined
- include: openstack_config.yml
when:
- openstack_config
- "{{ inventory_hostname == groups[mon_group_name] | last }}"
- name: find ceph keys
shell: ls -1 /etc/ceph/*.keyring
changed_when: false
register: ceph_keys
always_run: true
when: cephx
- name: set keys permissions
file:
path: "{{ item }}"
owner: "ceph"
group: "ceph"
mode: "0600"
with_items:
- "{{ ceph_keys.get('stdout_lines') | default([]) }}"
when: cephx
- name: copy keys to the ansible server
fetch:
src: "{{ item }}"
dest: "{{ fetch_directory }}/{{ fsid }}/{{ item }}"
flat: yes
with_items:
- "{{ ceph_keys.get('stdout_lines') | default([]) }}"
- /var/lib/ceph/bootstrap-osd/{{ cluster }}.keyring
- /var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring
- /var/lib/ceph/bootstrap-mds/{{ cluster }}.keyring
when:
- cephx
- inventory_hostname == groups[mon_group_name]|last
- name: drop in a motd script to report status when logging in
copy:
src: precise/92-ceph
dest: /etc/update-motd.d/92-ceph
owner: root
group: root
mode: 0755
when: ansible_distribution_release == 'precise'