deep_scrub_choked

roles/ceph-rgw/tasks/common.yml

@@ -0,0 +1,44 @@
+---
+- name: Get keys from monitors
+  ceph_key_info:
+    name: "{{ item.name }}"
+    cluster: "{{ cluster }}"
+    output_format: plain
+    state: info
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  register: _rgw_keys
+  with_items:
+    - { name: "client.bootstrap-rgw", path: "/var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring", copy_key: true }
+    - { name: "client.admin", path: "/etc/ceph/{{ cluster }}.client.admin.keyring", copy_key: "{{ copy_admin_key }}" }
+  delegate_to: "{{ groups.get(mon_group_name)[0] }}"
+  run_once: true
+  when:
+    - cephx | bool
+    - item.copy_key | bool
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+- name: Copy ceph key(s) if needed
+  ansible.builtin.copy:
+    dest: "{{ item.item.path }}"
+    content: "{{ item.stdout + '\n' }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "{{ ceph_keyring_permissions }}"
+  with_items: "{{ _rgw_keys.results }}"
+  when:
+    - cephx | bool
+    - item is not skipped
+    - item.item.copy_key | bool
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+- name: Copy SSL certificate & key data to certificate path
+  ansible.builtin.copy:
+    content: "{{ radosgw_frontend_ssl_certificate_data }}"
+    dest: "{{ radosgw_frontend_ssl_certificate }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0440"
+  when: radosgw_frontend_ssl_certificate | length > 0 and radosgw_frontend_ssl_certificate_data | length > 0
+  notify: Restart ceph rgws

roles/ceph-rgw/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+- name: Include common.yml
+  ansible.builtin.include_tasks: common.yml
+
+- name: Include_tasks pre_requisite.yml
+  ansible.builtin.include_tasks: pre_requisite.yml
+
+- name: Rgw pool creation tasks
+  ansible.builtin.include_tasks: rgw_create_pools.yml
+  run_once: true
+  when: rgw_create_pools is defined
+
+- name: Include_tasks openstack-keystone.yml
+  ansible.builtin.include_tasks: openstack-keystone.yml
+  when: radosgw_keystone_ssl | bool
+
+- name: Include_tasks start_radosgw.yml
+  ansible.builtin.include_tasks: start_radosgw.yml
+  when:
+    - not containerized_deployment | bool
+
+- name: Include start_docker_rgw.yml
+  ansible.builtin.include_tasks: start_docker_rgw.yml
+  when:
+    - containerized_deployment | bool

roles/ceph-rgw/tasks/openstack-keystone.yml

@@ -0,0 +1,32 @@
+---
+- name: Install nss-tools on redhat
+  ansible.builtin.package:
+    name: nss-tools
+    state: present
+  register: result
+  until: result is succeeded
+  when: ansible_facts['pkg_mgr'] == 'yum' or ansible_facts['pkg_mgr'] == 'dnf'
+
+- name: Install libnss3-tools on debian
+  ansible.builtin.package:
+    name: libnss3-tools
+    state: present
+  register: result
+  until: result is succeeded
+  when: ansible_facts['pkg_mgr'] == 'apt'
+
+- name: Create nss directory for keystone certificates
+  ansible.builtin.file:
+    path: "{{ radosgw_nss_db_path }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Create nss entries for keystone certificates
+  ansible.builtin.shell: "{{ item }}"
+  changed_when: false
+  with_items:
+    - "openssl x509 -in /etc/keystone/ssl/certs/ca.pem -pubkey | certutil -d {{ radosgw_nss_db_path }} -A -n ca -t 'TCu,Cu,Tuw'"
+    - "openssl x509 -in /etc/keystone/ssl/certs/signing_cert.pem -pubkey | certutil -A -d {{ radosgw_nss_db_path }} -n signing_cert -t 'P,P,P'"
+  tags: skip_ansible_lint

roles/ceph-rgw/tasks/pre_requisite.yml

@@ -0,0 +1,64 @@
+---
+- name: Create rados gateway directories
+  ansible.builtin.file:
+    path: "/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}"
+    state: directory
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "{{ ceph_directories_mode }}"
+  delegate_to: "{{ groups.get(mon_group_name, [])[0] }}"
+  loop: "{{ rgw_instances }}"
+  when: groups.get(mon_group_name, []) | length > 0
+
+- name: Create rgw keyrings
+  ceph_key:
+    name: "client.rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}"
+    cluster: "{{ cluster }}"
+    user: "client.bootstrap-rgw"
+    user_key: /var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring
+    dest: "/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}/keyring"
+    caps:
+      osd: 'allow rwx'
+      mon: 'allow rw'
+    import_key: "{{ True if groups.get(mon_group_name, []) | length > 0 else False }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "0600"
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+  delegate_to: "{{ groups[mon_group_name][0] if groups.get(mon_group_name, []) | length > 0 else 'localhost' }}"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  with_items: "{{ rgw_instances }}"
+  when: cephx | bool
+
+- name: Get keys from monitors
+  ceph_key_info:
+    name: "client.rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}"
+    cluster: "{{ cluster }}"
+    output_format: plain
+    state: info
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  register: _rgw_keys
+  loop: "{{ rgw_instances }}"
+  delegate_to: "{{ groups.get(mon_group_name)[0] }}"
+  when:
+    - cephx | bool
+    - groups.get(mon_group_name, []) | length > 0
+  no_log: "{{ no_log_on_ceph_key_tasks }}"
+
+- name: Copy ceph key(s) if needed
+  ansible.builtin.copy:
+    dest: "/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.item.instance_name }}/keyring"
+    content: "{{ item.stdout + '\n' }}"
+    owner: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    group: "{{ ceph_uid if containerized_deployment | bool else 'ceph' }}"
+    mode: "{{ ceph_keyring_permissions }}"
+  with_items: "{{ _rgw_keys.results }}"
+  when:
+    - cephx | bool
+    - item is not skipped
+    - groups.get(mon_group_name, []) | length > 0
+  no_log: "{{ no_log_on_ceph_key_tasks }}"

roles/ceph-rgw/tasks/rgw_create_pools.yml

@@ -0,0 +1,52 @@
+---
+- name: Create ec profile
+  ceph_ec_profile:
+    name: "{{ item.value.ec_profile }}"
+    cluster: "{{ cluster }}"
+    k: "{{ item.value.ec_k | default(omit) }}"
+    m: "{{ item.value.ec_m | default(omit) }}"
+    crush_device_class: "{{ item.value.ec_crush_device_class | default(omit) }}"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  loop: "{{ rgw_create_pools | dict2items }}"
+  when:
+    - item.value.create_profile | default(true)
+    - item.value.type | default('') == 'ec'
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+
+- name: Set crush rule
+  ceph_crush_rule:
+    name: "{{ item.key }}"
+    cluster: "{{ cluster }}"
+    rule_type: erasure
+    profile: "{{ item.value.ec_profile }}"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"
+  loop: "{{ rgw_create_pools | dict2items }}"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  when:
+    - item.value.create_profile | default(true)
+    - item.value.type | default('') == 'ec'
+
+- name: Create rgw pools
+  ceph_pool:
+    name: "{{ item.key }}"
+    state: present
+    cluster: "{{ cluster }}"
+    pg_num: "{{ item.value.pg_num | default(omit) }}"
+    pgp_num: "{{ item.value.pgp_num | default(omit) }}"
+    size: "{{ item.value.size | default(omit) }}"
+    min_size: "{{ item.value.min_size | default(omit) }}"
+    pg_autoscale_mode: "{{ item.value.pg_autoscale_mode | default(omit) }}"
+    target_size_ratio: "{{ item.value.target_size_ratio | default(omit) }}"
+    pool_type: "{{ 'erasure' if item.value.type | default('') == 'ec' else 'replicated' }}"
+    erasure_profile: "{{ item.value.ec_profile | default(omit) }}"
+    rule_name: "{{ item.value.rule_name if item.value.rule_name is defined else item.key if item.value.type | default('') == 'ec' else ceph_osd_pool_default_crush_rule_name }}"
+    application: rgw
+  loop: "{{ rgw_create_pools | dict2items }}"
+  delegate_to: "{{ groups[mon_group_name][0] }}"
+  environment:
+    CEPH_CONTAINER_IMAGE: "{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment | bool else None }}"
+    CEPH_CONTAINER_BINARY: "{{ container_binary }}"

roles/ceph-rgw/tasks/start_docker_rgw.yml

@@ -0,0 +1,12 @@
+---
+- name: Include_task systemd.yml
+  ansible.builtin.include_tasks: systemd.yml
+
+- name: Systemd start rgw container
+  ansible.builtin.systemd:
+    name: ceph-radosgw@rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}
+    state: started
+    enabled: true
+    masked: false
+    daemon_reload: true
+  with_items: "{{ rgw_instances }}"

roles/ceph-rgw/tasks/start_radosgw.yml

@@ -0,0 +1,29 @@
+---
+- name: Ensure systemd service override directory exists
+  ansible.builtin.file:
+    state: directory
+    path: "/etc/systemd/system/ceph-radosgw@.service.d/"
+    mode: "0750"
+  when: ceph_rgw_systemd_overrides is defined
+
+- name: Add ceph-rgw systemd service overrides
+  openstack.config_template.config_template:
+    src: "ceph-rgw.service.d-overrides.j2"
+    dest: "/etc/systemd/system/ceph-radosgw@.service.d/ceph-radosgw-systemd-overrides.conf"
+    config_overrides: "{{ ceph_rgw_systemd_overrides | default({}) }}"
+    config_type: "ini"
+  when: ceph_rgw_systemd_overrides is defined
+
+- name: Start rgw instance
+  ansible.builtin.systemd:
+    name: ceph-radosgw@rgw.{{ rgw_zone }}.{{ ansible_facts['hostname'] }}.{{ item.instance_name }}
+    state: started
+    enabled: true
+    masked: false
+  with_items: "{{ rgw_instances }}"
+
+- name: Enable the ceph-radosgw.target service
+  ansible.builtin.systemd:
+    name: ceph-radosgw.target
+    enabled: true
+    masked: false

roles/ceph-rgw/tasks/systemd.yml

@@ -0,0 +1,23 @@
+---
+- name: Generate systemd unit file
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/ceph-radosgw.service.j2"
+    dest: /etc/systemd/system/ceph-radosgw@.service
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: Restart ceph rgws
+
+- name: Generate systemd ceph-radosgw target file
+  ansible.builtin.copy:
+    src: ceph-radosgw.target
+    dest: /etc/systemd/system/ceph-radosgw.target
+    mode: "0644"
+  when: containerized_deployment | bool
+
+- name: Enable ceph-radosgw.target
+  ansible.builtin.service:
+    name: ceph-radosgw.target
+    enabled: true
+    daemon_reload: true
+  when: containerized_deployment | bool