deep_scrub_choked

2026-04-06 07:08:17 +03:00
commit 9149dc1d7f
840 changed files with 52471 additions and 0 deletions
@@ -0,0 +1,32 @@
+---
+- name: Waiting for the monitor(s) to form the quorum...
+  ansible.builtin.command: >
+    {{ container_exec_cmd }}
+    ceph
+    --cluster {{ cluster }}
+    daemon mon.{{ ansible_facts['hostname'] }}
+    mon_status
+    --format json
+  register: ceph_health_raw
+  run_once: true
+  until: >
+    (ceph_health_raw.stdout | length > 0) and (ceph_health_raw.stdout | default('{}') | from_json)['state'] in ['leader', 'peon']
+  retries: "{{ handler_health_mon_check_retries }}"
+  delay: "{{ handler_health_mon_check_delay }}"
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Fetch ceph initial keys
+  ceph_key:
+    state: fetch_initial_keys
+    cluster: "{{ cluster }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+    CEPH_ROLLING_UPDATE: "{{ rolling_update }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
@@ -0,0 +1,201 @@
+---
+- name: Cephx related tasks
+  when: cephx | bool
+  block:
+    - name: Check if monitor initial keyring already exists
+      ceph_key_info:
+        name: mon.
+        cluster: "{{ cluster }}"
+        user: mon.
+        user_key: "/var/lib/ceph/mon/{{ cluster }}-{{ hostvars[running_mon]['ansible_facts']['hostname'] }}/keyring"
+        output_format: json
+        state: info
+      environment:
+        CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+        CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+      register: initial_mon_key
+      run_once: true
+      delegate_to: "{{ running_mon }}"
+      failed_when: initial_mon_key.rc not in [0, 2]
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      when: running_mon is defined
+
+    - name: Generate monitor initial keyring
+      ceph_key:
+        state: generate_secret
+      register: monitor_keyring
+      delegate_to: localhost
+      become: false
+      run_once: true
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      when:
+        - initial_mon_key is skipped
+          or
+          initial_mon_key is not succeeded
+
+    - name: Set_fact _initial_mon_key_success
+      ansible.builtin.set_fact:  # when initial_mon_key is registered above, `rc: 2` is considered success.
+        _initial_mon_key_success: "{{ initial_mon_key is not skipped and initial_mon_key.rc == 0 }}"
+
+    - name: Get initial keyring when it already exists
+      ansible.builtin.set_fact:
+        monitor_keyring: "{{ (initial_mon_key.stdout | from_json)[0]['key'] if _initial_mon_key_success | bool else monitor_keyring.stdout }}"
+      when: initial_mon_key.stdout|default('')|length > 0 or monitor_keyring is not skipped
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+    - name: Create monitor initial keyring
+      ceph_key:
+        name: mon.
+        dest: "/var/lib/ceph/tmp/"
+        secret: "{{ monitor_keyring }}"
+        cluster: "{{ cluster }}"
+        caps:
+          mon: allow *
+        import_key: false
+        owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+        group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+        mode: "0400"
+      no_log: "{{ no_log_on_ceph_key_tasks }}"
+      environment:
+        CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+        CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+
+    - name: Copy the initial key in /etc/ceph (for containers)
+      ansible.builtin.copy:
+        src: /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
+        dest: /etc/ceph/{{ cluster }}.mon.keyring
+        remote_src: true
+        mode: "0640"
+      when: containerized_deployment | bool
+
+- name: Create monitor directory
+  ansible.builtin.file:
+    path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
+    state: directory
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "{{ ceph_directories_mode }}"
+
+# We don't do the recursion in the task above to avoid setting `mode` (which
+# defaults to 0755) on files.
+#
+# This is only needed when upgrading from older versions of Ceph that used to
+# run as `root` (https://github.com/ceph/ceph-ansible/issues/1635).
+- name: Recursively fix ownership of monitor directory
+  ansible.builtin.file:
+    path: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}
+    state: directory
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    recurse: true
+
+- name: Create admin keyring
+  ceph_authtool:
+    name: client.admin
+    path: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+    caps:
+      mon: allow *
+      mgr: allow *
+      osd: allow *
+      mds: allow *
+    create_keyring: true
+    gen_key: "{{ True if admin_secret == 'admin_secret' else omit }}"
+    add_key: "{{ admin_secret if admin_secret != 'admin_secret' else omit }}"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  run_once: true
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
+
+
+- name: Slurp admin keyring
+  ansible.builtin.slurp:
+    src: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  run_once: true
+  register: admin_keyring
+
+- name: Copy admin keyring over to mons
+  ansible.builtin.copy:
+    dest: "{{ admin_keyring.source }}"
+    content: "{{ admin_keyring.content | b64decode }}"
+    owner: "{{ ceph_uid }}"
+    group: "{{ ceph_uid }}"
+    mode: "0600"
+  delegate_to: "{{ item }}"
+  loop: "{{ groups[mon_group_name] }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+- name: Import admin keyring into mon keyring
+  ceph_authtool:
+    path: "/var/lib/ceph/tmp/{{ cluster }}.mon..keyring"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0400"
+    import_keyring: "/etc/ceph/{{ cluster }}.client.admin.keyring"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  when:
+    - cephx | bool
+
+- name: Set_fact ceph-mon container command
+  ansible.builtin.set_fact:
+    ceph_mon_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=ceph-mon ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'ceph-mon' }}"
+
+- name: Set_fact monmaptool container command
+  ansible.builtin.set_fact:
+    ceph_monmaptool_cmd: "{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=monmaptool ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment | bool else 'monmaptool' }}"
+
+- name: Generate initial monmap
+  ansible.builtin.command: >
+    {{ ceph_monmaptool_cmd }}
+    --create
+    {% for name, addr in _monitor_addresses.items() -%}
+    --addv
+    {{ hostvars[name]['ansible_facts']['hostname'] }}
+    {% if mon_host_v1.enabled | bool %}
+    {% set _v1 = ',v1:' + addr + mon_host_v1.suffix %}
+    {% endif %}
+    [{{ "v2:" + addr + mon_host_v2.suffix }}{{ _v1 | default('') }}]
+    {# {%- if not loop.last -%},{%- endif %} #}
+    {%- endfor %}
+    --enable-all-features
+    --clobber /etc/ceph/monmap
+  args:
+    creates: /etc/ceph/monmap
+
+- name: Ceph monitor mkfs with keyring
+  ansible.builtin.command: >
+    {{ ceph_mon_cmd }}
+    --cluster {{ cluster }}
+    --setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --mkfs
+    -i {{ monitor_name }}
+    --fsid {{ fsid }}
+    --keyring /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
+    --monmap /etc/ceph/monmap
+  args:
+    creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/keyring
+  when: cephx | bool
+
+- name: Ceph monitor mkfs without keyring
+  ansible.builtin.command: >
+    {{ ceph_mon_cmd }}
+    --cluster {{ cluster }}
+    --setuser "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --setgroup "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    --mkfs
+    -i {{ monitor_name }}
+    --fsid {{ fsid }}
+  args:
+    creates: /var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}/store.db
+  when: not cephx | bool
@@ -0,0 +1,39 @@
+---
+- name: Set_fact container_exec_cmd
+  ansible.builtin.set_fact:
+    container_exec_cmd: "{{ container_binary }} exec ceph-mon-{{ ansible_facts['hostname'] }}"
+  when: containerized_deployment | bool
+
+- name: Include deploy_monitors.yml
+  ansible.builtin.include_tasks: deploy_monitors.yml
+  when:
+    # we test for both container and non-container
+    - (mon_socket is defined and mon_socket.get('rc') != 0) or (ceph_mon_container_stat is defined and ceph_mon_container_stat.get('stdout_lines', [])|length == 0)
+    - not switch_to_containers | default(False) | bool
+
+- name: Include start_monitor.yml
+  ansible.builtin.include_tasks: start_monitor.yml
+
+- name: Include_tasks ceph_keys.yml
+  ansible.builtin.include_tasks: ceph_keys.yml
+  when: not switch_to_containers | default(False) | bool
+
+- name: Include secure_cluster.yml
+  ansible.builtin.include_tasks: secure_cluster.yml
+  when:
+    - secure_cluster | bool
+    - inventory_hostname == groups[mon_group_name] | first
+
+- name: Set cluster configs
+  ceph_config:
+    action: set
+    who: "{{ item.0.key }}"
+    option: "{{ item.1.key }}"
+    value: "{{ item.1.value }}"
+  run_once: true
+  when:
+    - item.1.value != omit
+  loop: "{{ ceph_cluster_conf | dict2dict }}"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
@@ -0,0 +1,15 @@
+---
+- name: Collect all the pools
+  ansible.builtin.command: >
+    {{ container_exec_cmd }} rados --cluster {{ cluster }} lspools
+  changed_when: false
+  register: ceph_pools
+  check_mode: false
+
+- name: Secure the cluster
+  ansible.builtin.command: >
+    {{ container_exec_cmd }} ceph --cluster {{ cluster }} osd pool set {{ item[0] }} {{ item[1] }} true
+  changed_when: false
+  with_nested:
+    - "{{ ceph_pools.stdout_lines | default([]) }}"
+    - "{{ secure_cluster_flags }}"
@@ -0,0 +1,33 @@
+---
+- name: Ensure systemd service override directory exists
+  ansible.builtin.file:
+    state: directory
+    path: "/etc/systemd/system/ceph-mon@.service.d/"
+    mode: "0755"
+  when:
+    - not containerized_deployment | bool
+    - ceph_mon_systemd_overrides is defined
+    - ansible_facts['service_mgr'] == 'systemd'
+
+- name: Add ceph-mon systemd service overrides
+  openstack.config_template.config_template:
+    src: "ceph-mon.service.d-overrides.j2"
+    dest: "/etc/systemd/system/ceph-mon@.service.d/ceph-mon-systemd-overrides.conf"
+    config_overrides: "{{ ceph_mon_systemd_overrides | default({}) }}"
+    config_type: "ini"
+  when:
+    - not containerized_deployment | bool
+    - ceph_mon_systemd_overrides is defined
+    - ansible_facts['service_mgr'] == 'systemd'
+
+- name: Include_tasks systemd.yml
+  ansible.builtin.include_tasks: systemd.yml
+  when: containerized_deployment | bool
+
+- name: Start the monitor service
+  ansible.builtin.systemd:
+    name: ceph-mon@{{ monitor_name if not containerized_deployment | bool else ansible_facts['hostname'] }}
+    state: started
+    enabled: true
+    masked: false
+    daemon_reload: true
@@ -0,0 +1,23 @@
+---
+- name: Generate systemd unit file for mon container
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/ceph-mon.service.j2"
+    dest: /etc/systemd/system/ceph-mon@.service
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: Restart ceph mons
+
+- name: Generate systemd ceph-mon target file
+  ansible.builtin.copy:
+    src: ceph-mon.target
+    dest: /etc/systemd/system/ceph-mon.target
+    mode: "0644"
+  when: containerized_deployment | bool
+
+- name: Enable ceph-mon.target
+  ansible.builtin.service:
+    name: ceph-mon.target
+    enabled: true
+    daemon_reload: true
+  when: containerized_deployment | bool