deep_scrub_choked

2026-04-06 07:08:17 +03:00
commit 9149dc1d7f
840 changed files with 52471 additions and 0 deletions
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!) The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [2014] [Sébastien Han]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,3 @@
+# Ansible role: ceph-mon
+
+Documentation is available at http://docs.ceph.com/ceph-ansible/.
@@ -0,0 +1,69 @@
+---
+# You can override vars by using host or group vars
+
+###########
+# GENERAL #
+###########
+mon_group_name: mons
+
+# ACTIVATE BOTH FSID AND MONITOR_SECRET VARIABLES FOR NON-VAGRANT DEPLOYMENT
+monitor_secret: "{{ monitor_keyring.stdout }}"
+admin_secret: 'admin_secret'
+
+# Secure your cluster
+# This will set the following flags on all the pools:
+# * nosizechange
+# * nopgchange
+# * nodelete
+
+secure_cluster: false
+secure_cluster_flags:
+  - nopgchange
+  - nodelete
+  - nosizechange
+
+client_admin_ceph_authtool_cap:
+  mon: allow *
+  osd: allow *
+  mds: allow *
+  mgr: allow *
+
+
+##########
+# DOCKER #
+##########
+
+# Resource limitation
+# For the whole list of limits you can apply see: docs.docker.com/engine/admin/resource_constraints
+# Default values are based from: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html/red_hat_ceph_storage_hardware_guide/minimum_recommendations
+ceph_mon_docker_memory_limit: "{{ ansible_facts['memtotal_mb'] }}m"
+ceph_mon_docker_cpu_limit: 1
+ceph_mon_container_listen_port: 3300
+
+# Use this variable to modify the configuration to run your mon container.
+mon_docker_privileged: false
+mon_docker_net_host: true
+ceph_config_keys: [] # DON'T TOUCH ME
+# If you want to add parameters, you should retain the existing ones and include the new ones.
+ceph_mon_container_params:
+  volumes:
+    - /var/lib/ceph/mon:/var/lib/ceph/mon:z,rshared
+  args:
+    - -f
+    - --default-mon-cluster-log-to-file=false
+    - --default-mon-cluster-log-to-stderr=true
+    - -i={{ monitor_name }}
+    - --mon-data=/var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
+    - --public-addr={{ _monitor_addresses[inventory_hostname] }}
+    - --mon-initial-members={{ groups[mon_group_name] | map('extract', hostvars, 'ansible_facts') | map(attribute='hostname') | join(',') }}
+
+
+###########
+# SYSTEMD #
+###########
+# ceph_mon_systemd_overrides will override the systemd settings
+# for the ceph-mon services.
+# For example,to set "PrivateDevices=false" you can specify:
+# ceph_mon_systemd_overrides:
+#   Service:
+#     PrivateDevices: false
@@ -0,0 +1,8 @@
+[Unit]
+Description=ceph target allowing to start/stop all ceph-mon@.service instances at once
+PartOf=ceph.target
+Before=ceph.target
+Wants=ceph.target
+
+[Install]
+WantedBy=multi-user.target ceph.target
@@ -0,0 +1,14 @@
+---
+galaxy_info:
+  company: Red Hat
+  author: Sébastien Han
+  description: Installs Ceph Monitor
+  license: Apache
+  min_ansible_version: '2.7'
+  platforms:
+    - name: EL
+      versions:
+        - 'all'
+  galaxy_tags:
+    - system
+dependencies: []
@@ -0,0 +1,32 @@
+---
+- name: Waiting for the monitor(s) to form the quorum...
+  ansible.builtin.command: >
+    {{ container_exec_cmd }}
+    ceph
+    --cluster {{ cluster }}
+    daemon mon.{{ ansible_facts['hostname'] }}
+    mon_status
+    --format json
+  register: ceph_health_raw
+  run_once: true
+  until: >
+    (ceph_health_raw.stdout | length > 0) and (ceph_health_raw.stdout | default('{}') | from_json)['state'] in ['leader', 'peon']
+  retries: "{{ handler_health_mon_check_retries }}"
+  delay: "{{ handler_health_mon_check_delay }}"
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Fetch ceph initial keys
+  ceph_key:
+    state: fetch_initial_keys
+    cluster: "{{ cluster }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+    CEPH_ROLLING_UPDATE: "{{ rolling_update }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
@@ -0,0 +1,201 @@
+---
+- name: Cephx related tasks
+  when: cephx | bool
+  block:
+    - name: Check if monitor initial keyring already exists
+      ceph_key_info:
+        name: mon.
+        cluster: "{{ cluster }}"
+        user: mon.
+        user_key: "/var/lib/ceph/mon/{{ cluster }}-{{ hostvars[running_mon]['ansible_facts']['hostname'] }}/keyring"
+        output_format: json
+        state: info
+      environment:
+        CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+        CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+      register: initial_mon_key
+      run_once: true
+      delegate_to: "{{ running_mon }}"
+      failed_when: initial_mon_key.rc not in [0, 2]
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      when: running_mon is defined
+
+    - name: Generate monitor initial keyring
+      ceph_key:
+        state: generate_secret
+      register: monitor_keyring
+      delegate_to: localhost
+      become: false
+      run_once: true
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      when:
+        - initial_mon_key is skipped
+          or
+          initial_mon_key is not succeeded
+
+    - name: Set_fact _initial_mon_key_success
+      ansible.builtin.set_fact:  # when initial_mon_key is registered above, `rc: 2` is considered success.
+        _initial_mon_key_success: "{{ initial_mon_key is not skipped and initial_mon_key.rc == 0 }}"
+
+    - name: Get initial keyring when it already exists
+      ansible.builtin.set_fact:
+        monitor_keyring: "{{ (initial_mon_key.stdout | from_json)[0]['key'] if _initial_mon_key_success | bool else monitor_keyring.stdout }}"
+      when: initial_mon_key.stdout|default('')|length > 0 or monitor_keyring is not skipped
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+    - name: Create monitor initial keyring
+      ceph_key:
+        name: mon.
+        dest: "/var/lib/ceph/tmp/"
+        secret: "{{ monitor_keyring }}"
+        cluster: "{{ cluster }}"
+        caps:
+          mon: allow *
+        import_key: false
+        owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+        group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+        mode: "0400"
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      environment:
+        CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+        CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+
+    - name: Copy the initial key in /etc/ceph (for containers)
+      ansible.builtin.copy:
+        src: /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
+        dest: /etc/ceph/{{ cluster }}.mon.keyring
+        remote_src: true
+        mode: "0640"
+      when: containerized_deployment | bool
+
+- name: Create monitor directory
+  ansible.builtin.file:
+    path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
+    state: directory
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "{{ ceph_directories_mode }}"
+
+# We don't do the recursion in the task above to avoid setting `mode` (which
+# defaults to 0755) on files.
+#
+# This is only needed when upgrading from older versions of Ceph that used to
+# run as `root` (https://github.com/ceph/ceph-ansible/issues/1635).
+- name: Recursively fix ownership of monitor directory
+  ansible.builtin.file:
+    path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
+    state: directory
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    recurse: true
+
+- name: Create admin keyring
+  ceph_authtool:
+    name: client.admin
+    path: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+    caps:
+      mon: allow *
+      mgr: allow *
+      osd: allow *
+      mds: allow *
+    create_keyring: true
+    gen_key: "{{ True if admin_secret == 'admin_secret' else omit }}"
+    add_key: "{{ admin_secret if admin_secret != 'admin_secret' else omit }}"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  run_once: true
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
+
+
+- name: Slurp admin keyring
+  ansible.builtin.slurp:
+    src: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  run_once: true
+  register: admin_keyring
+
+- name: Copy admin keyring over to mons
+  ansible.builtin.copy:
+    dest: "{{ admin_keyring.source }}"
+    content: "{{ admin_keyring.content | b64decode }}"
+    owner: "{{ ceph_uid }}"
+    group: "{{ ceph_uid }}"
+    mode: "0600"
+  delegate_to: "{{ item }}"
+  loop: "{{ groups[mon_group_name] }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+- name: Import admin keyring into mon keyring
+  ceph_authtool:
+    path: "/var/lib/ceph/tmp/{{ cluster }}.mon..keyring"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+    import_keyring: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
+
+- name: Set_fact ceph-mon container command
+  ansible.builtin.set_fact:
+    ceph_mon_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=ceph-mon ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'ceph-mon' }}"
+
+- name: Set_fact monmaptool container command
+  ansible.builtin.set_fact:
+    ceph_monmaptool_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=monmaptool ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'monmaptool' }}"
+
+- name: Generate initial monmap
+  ansible.builtin.command: >
+    {{ ceph_monmaptool_cmd }}
+    --create
+    {% for name, addr in _monitor_addresses.items() -%}
+    --addv
+    {{ hostvars[name]['ansible_facts']['hostname'] }}
+    {% if mon_host_v1.enabled | bool %}
+    {% set _v1 = ',v1:' + addr + mon_host_v1.suffix %}
+    {% endif %}
+    [{{ "v2:" + addr + mon_host_v2.suffix }}{{ _v1 | default('') }}]
+    {# {%- if not loop.last -%},{%- endif %} #}
+    {%- endfor %}
+    --enable-all-features
+    --clobber /etc/ceph/monmap
+  args:
+    creates: /etc/ceph/monmap
+
+- name: Ceph monitor mkfs with keyring
+  ansible.builtin.command: >
+    {{ ceph_mon_cmd }}
+    --cluster {{ cluster }}
+    --setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --mkfs
+    -i {{ monitor_name }}
+    --fsid {{ fsid }}
+    --keyring /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
+    --monmap /etc/ceph/monmap
+  args:
+    creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/keyring
+  when: cephx | bool
+
+- name: Ceph monitor mkfs without keyring
+  ansible.builtin.command: >
+    {{ ceph_mon_cmd }}
+    --cluster {{ cluster }}
+    --setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --mkfs
+    -i {{ monitor_name }}
+    --fsid {{ fsid }}
+  args:
+    creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/store.db
+  when: not cephx | bool
@@ -0,0 +1,39 @@
+---
+- name: Set_fact container_exec_cmd
+  ansible.builtin.set_fact:
+    container_exec_cmd: "{{ container_binary }} exec ceph-mon-{{ ansible_facts['hostname'] }}"
+  when: containerized_deployment | bool
+
+- name: Include deploy_monitors.yml
+  ansible.builtin.include_tasks: deploy_monitors.yml
+  when:
+    # we test for both container and non-container
+    - (mon_socket is defined and mon_socket.get('rc') != 0) or (ceph_mon_container_stat is defined and ceph_mon_container_stat.get('stdout_lines', [])|length == 0)
+    - not switch_to_containers | default(False) | bool
+
+- name: Include start_monitor.yml
+  ansible.builtin.include_tasks: start_monitor.yml
+
+- name: Include_tasks ceph_keys.yml
+  ansible.builtin.include_tasks: ceph_keys.yml
+  when: not switch_to_containers | default(False) | bool
+
+- name: Include secure_cluster.yml
+  ansible.builtin.include_tasks: secure_cluster.yml
+  when:
+    - secure_cluster | bool
+    - inventory_hostname == groups[mon_group_name] | first
+
+- name: Set cluster configs
+  ceph_config:
+    action: set
+    who: "{{ item.0.key }}"
+    option: "{{ item.1.key }}"
+    value: "{{ item.1.value }}"
+  run_once: true
+  when:
+    - item.1.value != omit
+  loop: "{{ ceph_cluster_conf | dict2dict }}"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
@@ -0,0 +1,15 @@
+---
+- name: Collect all the pools
+  ansible.builtin.command: >
+    {{ container_exec_cmd }} rados --cluster {{ cluster }} lspools
+  changed_when: false
+  register: ceph_pools
+  check_mode: false
+
+- name: Secure the cluster
+  ansible.builtin.command: >
+    {{ container_exec_cmd }} ceph --cluster {{ cluster }} osd pool set {{ item[0] }} {{ item[1] }} true
+  changed_when: false
+  with_nested:
+    - "{{ ceph_pools.stdout_lines | default([]) }}"
+    - "{{ secure_cluster_flags }}"
@@ -0,0 +1,33 @@
+---
+- name: Ensure systemd service override directory exists
+  ansible.builtin.file:
+    state: directory
+    path: "/etc/systemd/system/ceph-mon@.service.d/"
+    mode: "0755"
+  when:
+    - not containerized_deployment | bool
+    - ceph_mon_systemd_overrides is defined
+    - ansible_facts['service_mgr'] == 'systemd'
+
+- name: Add ceph-mon systemd service overrides
+  openstack.config_template.config_template:
+    src: "ceph-mon.service.d-overrides.j2"
+    dest: "/etc/systemd/system/ceph-mon@.service.d/ceph-mon-systemd-overrides.conf"
+    config_overrides: "{{ ceph_mon_systemd_overrides | default({}) }}"
+    config_type: "ini"
+  when:
+    - not containerized_deployment | bool
+    - ceph_mon_systemd_overrides is defined
+    - ansible_facts['service_mgr'] == 'systemd'
+
+- name: Include_tasks systemd.yml
+  ansible.builtin.include_tasks: systemd.yml
+  when: containerized_deployment | bool
+
+- name: Start the monitor service
+  ansible.builtin.systemd:
+    name: ceph-mon@{{ monitor_name if not containerized_deployment | bool else ansible_facts['hostname'] }}
+    state: started
+    enabled: true
+    masked: false
+    daemon_reload: true
@@ -0,0 +1,23 @@
+---
+- name: Generate systemd unit file for mon container
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/ceph-mon.service.j2"
+    dest: /etc/systemd/system/ceph-mon@.service
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: Restart ceph mons
+
+- name: Generate systemd ceph-mon target file
+  ansible.builtin.copy:
+    src: ceph-mon.target
+    dest: /etc/systemd/system/ceph-mon.target
+    mode: "0644"
+  when: containerized_deployment | bool
+
+- name: Enable ceph-mon.target
+  ansible.builtin.service:
+    name: ceph-mon.target
+    enabled: true
+    daemon_reload: true
+  when: containerized_deployment | bool
@@ -0,0 +1 @@
+# {{ ansible_managed }}
@@ -0,0 +1,66 @@
+[Unit]
+Description=Ceph Monitor
+PartOf=ceph-mon.target
+{% if container_binary == 'docker' %}
+After=docker.service network-online.target local-fs.target time-sync.target
+Requires=docker.service
+{% else %}
+After=network-online.target local-fs.target time-sync.target
+{% endif %}
+Wants=network-online.target local-fs.target time-sync.target
+
+[Service]
+EnvironmentFile=-/etc/environment
+{% if container_binary == 'podman' %}
+ExecStartPre=-/usr/bin/rm -f /%t/%n-pid /%t/%n-cid
+ExecStartPre=-/usr/bin/{{ container_binary }} rm --storage ceph-mon-%i
+ExecStartPre=-/usr/bin/mkdir -p /var/log/ceph
+{% else %}
+ExecStartPre=-/usr/bin/{{ container_binary }} stop ceph-mon-%i
+{% endif %}
+ExecStartPre=-/usr/bin/{{ container_binary }} rm ceph-mon-%i
+ExecStartPre=/bin/sh -c '"$(command -v mkdir)" -p /etc/ceph /var/lib/ceph/mon'
+ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-mon-%i \
+{% if container_binary == 'podman' %}
+  -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \
+{% endif %}
+  --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \
+  --memory={{ ceph_mon_docker_memory_limit }} \
+  --cpus={{ ceph_mon_docker_cpu_limit }} \
+  --security-opt label=disable \
+{% for v in ceph_common_container_params['volumes'] + ceph_mon_container_params['volumes'] | default([]) %}
+  -v {{ v }} \
+{% endfor %}
+{% if ansible_facts['os_family'] == 'RedHat' -%}
+  -v /etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted \
+{% endif -%}
+{% if mon_docker_privileged | bool -%}
+  --privileged \
+{% endif -%}
+{% if mon_docker_net_host | bool -%}
+  --net=host \
+{% endif -%}
+{% for k, v in (ceph_common_container_params['envs'] | combine(ceph_mon_container_params['envs'] | default({}))).items() %}
+  -e {{ k }}={{ v }} \
+{% endfor %}
+  --entrypoint=/usr/bin/ceph-mon \
+  {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} \
+  {{ (ceph_common_container_params['args'] + ceph_mon_container_params['args'] | default([])) | join(' ') }}
+{% if container_binary == 'podman' %}
+ExecStop=-/usr/bin/sh -c "/usr/bin/{{ container_binary }} rm -f `cat /%t/%n-cid`"
+{% else %}
+ExecStop=-/usr/bin/{{ container_binary }} stop ceph-mon-%i
+{% endif %}
+ExecStopPost=-/bin/rm -f /var/run/ceph/{{ cluster }}-mon.{{ monitor_name }}.asok
+KillMode=none
+Restart=always
+RestartSec=10s
+TimeoutStartSec=120
+TimeoutStopSec=15
+{% if container_binary == 'podman' %}
+Type=forking
+PIDFile=/%t/%n-pid
+{% endif %}
+
+[Install]
+WantedBy=ceph.target