deep_scrub_choked
This commit is contained in:
a.pivkin
@@ -0,0 +1,257 @@
|
||||
---
|
||||
- name: Check firewalld installation on redhat or SUSE/openSUSE
|
||||
ansible.builtin.command: rpm -q firewalld # noqa command-instead-of-module
|
||||
register: firewalld_pkg_query
|
||||
ignore_errors: true
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
tags: firewall
|
||||
|
||||
- name: Configuring firewalld
|
||||
when: (firewalld_pkg_query.get('rc', 1) == 0
|
||||
or is_atomic | bool)
|
||||
tags: firewall
|
||||
block:
|
||||
- name: Install firewalld python binding
|
||||
ansible.builtin.package:
|
||||
name: "python{{ ansible_facts['python']['version']['major'] }}-firewall"
|
||||
tags: with_pkg
|
||||
when: not is_atomic | bool
|
||||
|
||||
- name: Start firewalld
|
||||
ansible.builtin.service:
|
||||
name: firewalld
|
||||
state: started
|
||||
enabled: true
|
||||
register: result
|
||||
retries: 5
|
||||
delay: 3
|
||||
until: result is succeeded
|
||||
|
||||
- name: Open ceph networks on monitor
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_mon_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- mon_group_name is defined
|
||||
- mon_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on manager when collocated
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_mgr_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- mon_group_name is defined
|
||||
- mon_group_name in group_names
|
||||
- mgr_group_name | length == 0
|
||||
|
||||
- name: Open monitor and manager ports
|
||||
ansible.posix.firewalld:
|
||||
service: "{{ item.service }}"
|
||||
zone: "{{ item.zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items:
|
||||
- { 'service': 'ceph-mon', 'zone': "{{ ceph_mon_firewall_zone }}" }
|
||||
- { 'service': 'ceph', 'zone': "{{ ceph_mgr_firewall_zone }}" }
|
||||
when:
|
||||
- mon_group_name is defined
|
||||
- mon_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on manager when dedicated
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_mgr_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- mgr_group_name is defined
|
||||
- mgr_group_name in group_names
|
||||
- mgr_group_name | length > 0
|
||||
|
||||
- name: Open manager ports
|
||||
ansible.posix.firewalld:
|
||||
service: ceph
|
||||
zone: "{{ ceph_mgr_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- mgr_group_name is defined
|
||||
- mgr_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on osd
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_osd_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') | union(cluster_network.split(',')) }}"
|
||||
when:
|
||||
- osd_group_name is defined
|
||||
- osd_group_name in group_names
|
||||
|
||||
- name: Open osd ports
|
||||
ansible.posix.firewalld:
|
||||
service: ceph
|
||||
zone: "{{ ceph_osd_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- osd_group_name is defined
|
||||
- osd_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on rgw
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_rgw_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- rgw_group_name is defined
|
||||
- rgw_group_name in group_names
|
||||
|
||||
- name: Open rgw ports
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ item.radosgw_frontend_port }}/tcp"
|
||||
zone: "{{ ceph_rgw_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
loop: "{{ rgw_instances }}"
|
||||
when:
|
||||
- rgw_group_name is defined
|
||||
- rgw_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on mds
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_mds_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- mds_group_name is defined
|
||||
- mds_group_name in group_names
|
||||
|
||||
- name: Open mds ports
|
||||
ansible.posix.firewalld:
|
||||
service: ceph
|
||||
zone: "{{ ceph_mds_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- mds_group_name is defined
|
||||
- mds_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on nfs
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_nfs_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- nfs_group_name is defined
|
||||
- nfs_group_name in group_names
|
||||
|
||||
- name: Open nfs ports
|
||||
ansible.posix.firewalld:
|
||||
service: nfs
|
||||
zone: "{{ ceph_nfs_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- nfs_group_name is defined
|
||||
- nfs_group_name in group_names
|
||||
|
||||
- name: Open nfs ports (portmapper)
|
||||
ansible.posix.firewalld:
|
||||
port: "111/tcp"
|
||||
zone: "{{ ceph_nfs_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- nfs_group_name is defined
|
||||
- nfs_group_name in group_names
|
||||
|
||||
- name: Open ceph networks on rbdmirror
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_rbdmirror_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- rbdmirror_group_name is defined
|
||||
- rbdmirror_group_name in group_names
|
||||
|
||||
- name: Open rbdmirror ports
|
||||
ansible.posix.firewalld:
|
||||
service: ceph
|
||||
zone: "{{ ceph_rbdmirror_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- rbdmirror_group_name is defined
|
||||
- rbdmirror_group_name in group_names
|
||||
|
||||
- name: Open dashboard ports
|
||||
ansible.builtin.include_tasks: dashboard_firewall.yml
|
||||
when: dashboard_enabled | bool
|
||||
|
||||
- name: Open ceph networks on haproxy
|
||||
ansible.posix.firewalld:
|
||||
zone: "{{ ceph_rgwloadbalancer_firewall_zone }}"
|
||||
source: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items: "{{ public_network.split(',') }}"
|
||||
when:
|
||||
- rgwloadbalancer_group_name is defined
|
||||
- rgwloadbalancer_group_name in group_names
|
||||
|
||||
- name: Open haproxy ports
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ haproxy_frontend_port | default(80) }}/tcp"
|
||||
zone: "{{ ceph_rgwloadbalancer_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- rgwloadbalancer_group_name is defined
|
||||
- rgwloadbalancer_group_name in group_names
|
||||
|
||||
- name: Add rich rule for keepalived vrrp
|
||||
ansible.posix.firewalld:
|
||||
rich_rule: 'rule protocol value="vrrp" accept'
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when:
|
||||
- rgwloadbalancer_group_name is defined
|
||||
- rgwloadbalancer_group_name in group_names
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
- name: Open node_exporter port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ node_exporter_port }}/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open dashboard port in firewalld
|
||||
when:
|
||||
- mgr_group_name is defined
|
||||
- (groups.get(mgr_group_name,[]) | length > 0 and mgr_group_name in group_names) or
|
||||
(groups.get(mgr_group_name,[]) | length == 0 and mon_group_name in group_names)
|
||||
block:
|
||||
- name: Open dashboard port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ dashboard_port }}/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open mgr/prometheus port
|
||||
ansible.posix.firewalld:
|
||||
port: "9283/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open monitoring stack tcp ports in firewalld
|
||||
when:
|
||||
- monitoring_group_name is defined
|
||||
- monitoring_group_name in group_names
|
||||
block:
|
||||
- name: Open grafana port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ grafana_port }}/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open prometheus port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ prometheus_port }}/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open alertmanager port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ alertmanager_port }}/tcp"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Open alertmanager cluster port
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ alertmanager_cluster_port }}/{{ item }}"
|
||||
zone: "{{ ceph_dashboard_firewall_zone }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
with_items:
|
||||
- "tcp"
|
||||
- "udp"
|
||||
@@ -0,0 +1,53 @@
|
||||
---
|
||||
- name: Update cache for Debian based OSs
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
when: ansible_facts['os_family'] == "Debian"
|
||||
register: result
|
||||
until: result is succeeded
|
||||
tags: package-install
|
||||
|
||||
- name: Include_tasks configure_firewall.yml
|
||||
ansible.builtin.include_tasks: configure_firewall.yml
|
||||
when:
|
||||
- configure_firewall | bool
|
||||
- ansible_facts['os_family'] in ['RedHat', 'Suse']
|
||||
tags: configure_firewall
|
||||
|
||||
- name: Include_tasks setup_ntp.yml
|
||||
ansible.builtin.include_tasks: setup_ntp.yml
|
||||
when: ntp_service_enabled | bool
|
||||
tags: configure_ntp
|
||||
|
||||
- name: Ensure logrotate is installed
|
||||
ansible.builtin.package:
|
||||
name: logrotate
|
||||
state: present
|
||||
register: result
|
||||
until: result is succeeded
|
||||
tags: with_pkg
|
||||
when:
|
||||
- not is_atomic | bool
|
||||
- containerized_deployment | bool
|
||||
- inventory_hostname in groups.get(mon_group_name, []) or
|
||||
inventory_hostname in groups.get(osd_group_name, []) or
|
||||
inventory_hostname in groups.get(mds_group_name, []) or
|
||||
inventory_hostname in groups.get(rgw_group_name, []) or
|
||||
inventory_hostname in groups.get(mgr_group_name, []) or
|
||||
inventory_hostname in groups.get(rbdmirror_group_name, [])
|
||||
|
||||
- name: Add logrotate configuration
|
||||
ansible.builtin.template:
|
||||
src: logrotate.conf.j2
|
||||
dest: /etc/logrotate.d/ceph
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
when:
|
||||
- containerized_deployment | bool
|
||||
- inventory_hostname in groups.get(mon_group_name, []) or
|
||||
inventory_hostname in groups.get(osd_group_name, []) or
|
||||
inventory_hostname in groups.get(mds_group_name, []) or
|
||||
inventory_hostname in groups.get(rgw_group_name, []) or
|
||||
inventory_hostname in groups.get(mgr_group_name, []) or
|
||||
inventory_hostname in groups.get(rbdmirror_group_name, [])
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
- name: Set ntp service and chrony daemon name for Debian family
|
||||
ansible.builtin.set_fact:
|
||||
chrony_daemon_name: chrony
|
||||
ntp_service_name: ntp
|
||||
when: ansible_facts['os_family'] == 'Debian'
|
||||
|
||||
- name: Set ntp service and chrony daemon name for RedHat and Suse family
|
||||
ansible.builtin.set_fact:
|
||||
chrony_daemon_name: chronyd
|
||||
ntp_service_name: ntpd
|
||||
when: ansible_facts['os_family'] in ['RedHat', 'Suse']
|
||||
|
||||
# Installation of NTP daemons needs to be a separate task since installations
|
||||
# can't happen on Atomic
|
||||
- name: Install the ntp daemon
|
||||
when: not is_atomic | bool
|
||||
block:
|
||||
- name: Install ntpd
|
||||
ansible.builtin.package:
|
||||
name: ntp
|
||||
state: present
|
||||
register: result
|
||||
until: result is succeeded
|
||||
when: ntp_daemon_type == "ntpd"
|
||||
|
||||
- name: Install chrony
|
||||
ansible.builtin.package:
|
||||
name: chrony
|
||||
state: present
|
||||
register: result
|
||||
until: result is succeeded
|
||||
when: ntp_daemon_type == "chronyd"
|
||||
|
||||
- name: Enable the ntp daemon and disable the rest
|
||||
block:
|
||||
- name: Enable timesyncing on timesyncd
|
||||
ansible.builtin.command: timedatectl set-ntp on
|
||||
notify:
|
||||
- Disable ntpd
|
||||
- Disable chronyd
|
||||
changed_when: false
|
||||
when: ntp_daemon_type == "timesyncd"
|
||||
|
||||
- name: Disable time sync using timesyncd if we are not using it
|
||||
ansible.builtin.command: timedatectl set-ntp no
|
||||
changed_when: false
|
||||
when: ntp_daemon_type != "timesyncd"
|
||||
|
||||
- name: Enable ntpd
|
||||
ansible.builtin.service:
|
||||
name: "{{ ntp_service_name }}"
|
||||
enabled: true
|
||||
state: started
|
||||
notify:
|
||||
- Disable chronyd
|
||||
- Disable timesyncd
|
||||
when: ntp_daemon_type == "ntpd"
|
||||
|
||||
- name: Enable chronyd
|
||||
ansible.builtin.service:
|
||||
name: "{{ chrony_daemon_name }}"
|
||||
enabled: true
|
||||
state: started
|
||||
notify:
|
||||
- Disable ntpd
|
||||
- Disable timesyncd
|
||||
when: ntp_daemon_type == "chronyd"
|
||||
Reference in New Issue
Block a user