updated image of vaultwarden from 1.30.1 to 1.32.7

basics.yaml

@@ -1,25 +1,38 @@
-    - name: download asc and cephadm for ceph
+    - name: set FQDN
-      get_url:
+      hostname:
-        url: "{{ item.url }}"
+        name: "{{ inventory_hostname }}"
+        use: systemd
+
+    - name: set root password
+      ansible.builtin.user:
+        name: root
+        password: "{{ root_pass | password_hash('sha512')}}"
+
+    - name: set date and time manually to be able to interact with repo=
+      command: "{{ item }}"
+      loop:
+        - date -s "{{ now(utc=true,fmt='%Y-%m-%d %H:%M:%S') }}"
+        - hwclock --systohc
+
+    - import_role:
+        name: ansible-netplan
+
+    - name: update repos sources|sshd_config|repo_key
+      ansible.builtin.copy:
+        src: "{{ item.name }}"
         dest: "{{ item.dest }}"
       loop:
-        - { url: "https://nexus.test.repo.int.nt-com.ru/repository/keys/ceph/release.asc", dest: "/tmp" }
+        - {name: ceph.list,dest: /etc/apt/sources.list.d/ceph.list}
+        - {name: sshd_config,dest: /etc/ssh/sshd_config}
+        - {name: ceph.gpg,dest: /usr/share/keyrings/ceph.gpg}
 
-    - name: Delete previously install ceph.gpg
+    - name: Templating sources lists
-      file:
+      ansible.builtin.template:
-        path: /usr/share/keyrings/ceph.gpg
+        src: "{{ item.name }}"
-        state: absent
+        dest: "{{ item.dest }}"
-
+      loop:
-    - name: import downloaded asc
+        - { name: sources.list.j2,dest: /etc/apt/sources.list }
-      shell:
+        - { name: ceph.list.j2,dest: /etc/apt/sources.list.d/ceph.list }
-        chdir: /tmp
-        cmd: echo y | gpg -o /usr/share/keyrings/ceph.gpg --dearmor release.asc;
-
-    - name: Add ceph repo
-      apt_repository:
-        filename: ceph
-        repo: "deb [signed-by=/usr/share/keyrings/ceph.gpg] {{ ceph_repo }} {{ ansible_distribution_release }} main"
-        state: present
 
     - name: install packages
       apt:
@@ -30,14 +43,20 @@
           - podman
           - chrony
           - mc
+          - linux-tools-common
+          - linux-tools-`uname -r`
+          - ipmitool
         state: present
+        update_cache: yes
 
     - name: Setup ntp client
       template:
         src: chrony.yaml.j2
         dest: /etc/chrony/chrony.conf
-      notify:
+
-        - ceph-rollout:restart_chrony
+    - name: setup ipmi
+      import_role:
+        name: ansible-ipmitool
 
     - name: Templating cluster settings files
       template:
@@ -46,22 +65,15 @@
         trim_blocks: true
         lstrip_blocks: true
       loop:
-#        - { name: "ceph.conf.j2", dest: "/root/ceph.conf" }
         - { name: "cluster_spec.yml.j2", dest: "/root/cluster_spec.yml" }
         - { name: "initial-ceph.j2", dest: "/root/initial-ceph.conf" }
-        - { name: "sshd_config.j2", dest: "/etc/ssh/sshd_config"}
       run_once: true
       delegate_to: "{{ ansible_play_hosts[0] }}"
-      notify:
-        - ceph-rollout:restart_sshd
 
-    # UNCOMMENT ONLY IN CASE OF NO ACCESS TO REPOS AND CANNOT DOWNLOAD CEPHADM
+    - name: restart_services
-    #    - name: copy onto target host
+      ansible.builtin.systemd:
-    #      copy:
+        state: restarted
-    #        src: "cephadm"
+        name: "{{ item }}"
-    #        dest: "/root/cephadm"
+      loop:
-    #        mode: '0777'
+        - sshd
-    #      delegate_to: "{{ ansible_play_hosts[0] }}"
+        - chronyd
-
-    - name: Flush restart handlers
-      meta: flush_handlers

gprs_szfo.yaml

@@ -0,0 +1,17 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.szfo:
+      ansible_host: 10.50.8.88
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.szfo:
+      ansible_host: 10.50.8.89
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.szfo:
+      ansible_host: 10.50.8.90
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345

grafana.yaml

@@ -0,0 +1,3 @@
+service_type: grafana
+spec:
+  initial_admin_password: qweqwe

host_vars/node01.gprs.ceph.cfo

@@ -1,4 +1,4 @@
-addr: 10.52.37.14
+addr: 10.50.8.88
 location:
   root: default
 labels:

host_vars/node01.gprs.ceph.cfo.bkp

@@ -1,6 +1,7 @@
-addr: 10.52.37.16
+addr: 10.50.8.97
 location:
   root: default
 labels:
   - mon
   - osd
+  - mgr

host_vars/node01.gprs.ceph.szfo.yaml

@@ -1,4 +1,4 @@
-addr: 10.52.37.15
+addr: 10.50.8.88
 location:
   root: default
 labels:

host_vars/node01.gprs.ceph.ufo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.75
+location:
+  root: default
+labels:
+  - mon
+  - osd
+  - mgr

host_vars/node02.gprs.ceph.cfo

@@ -0,0 +1,5 @@
+addr: 10.50.8.89
+location:
+  root: default
+labels:
+  - osd

host_vars/node02.gprs.ceph.cfo.bkp

@@ -0,0 +1,5 @@
+addr: 10.50.8.98
+location:
+  root: default
+labels:
+  - osd

host_vars/node02.gprs.ceph.szfo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.89
+location:
+  root: default
+labels:
+#  - mon
+  - osd
+#  - mgr

host_vars/node02.gprs.ceph.ufo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.76
+location:
+  root: default
+labels:
+#  - mon
+  - osd
+#  - mgr

host_vars/node03.gprs.ceph.cfo

@@ -0,0 +1,5 @@
+addr: 10.50.8.90
+location:
+  root: default
+labels:
+  - osd

host_vars/node03.gprs.ceph.cfo.bkp

@@ -0,0 +1,5 @@
+addr: 10.50.8.99
+location:
+  root: default
+labels:
+  - osd

host_vars/node03.gprs.ceph.szfo.yaml

@@ -0,0 +1,6 @@
+addr: 10.50.8.90
+location:
+  root: default
+labels:
+#  - mon
+  - osd

host_vars/node03.gprs.ceph.ufo.yaml

@@ -0,0 +1,6 @@
+addr: 10.50.8.77
+location:
+  root: default
+labels:
+#  - mon
+  - osd

ingress.yaml

@@ -0,0 +1,12 @@
+service_type: ingress
+service_id: rgw.ingress
+placement:
+  hosts:
+    - ceph01
+    - ceph03
+spec:
+  backend_service: rgw.test
+  virtual_ip: 10.63.1.100/24
+  frontend_port: 80
+  monitor_port: 1967
+  virtual_interface_networks: 10.63.1.0/24

inv.yaml

@@ -1,17 +1,22 @@
 ceph-nodes:
   hosts:
-    ceph-node01:
+    node01.gprs.ceph.ufo:
-      ansible_host: 10.50.8.51
-      ansible_user: g10
-      ansible_ssh_pass: 12345
-      ansible_become_pass: 12345
-    ceph-node02:
       ansible_host: 10.50.8.75
       ansible_user: g10
       ansible_ssh_pass: 12345
       ansible_become_pass: 12345
-    ceph-node03:
+    node02.gprs.ceph.ufo:
       ansible_host: 10.50.8.76
       ansible_user: g10
       ansible_ssh_pass: 12345
       ansible_become_pass: 12345
+    node03.gprs.ceph.ufo:
+      ansible_host: 10.50.8.77
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

multi-1st.yaml

@@ -0,0 +1,22 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.cfo:
+      ansible_host: 10.50.8.88
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.cfo:
+      ansible_host: 10.50.8.89
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.cfo:
+      ansible_host: 10.50.8.90
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

multi-2nd.yaml

@@ -0,0 +1,22 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.97
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.98
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.99
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

pre-deploy.yml

@@ -4,21 +4,25 @@
   become: true
   gather_facts: true
   diff: true
+  vars_files:
+    - pass.yaml #encrypted pass for root
   vars:
-    ceph_repo: "http://nexus.test.repo.int.nt-com.ru/repository/ceph-squid/"
+    ceph_repo: "http://repo.infra.mts/debian-squid"
-    image_registry: "harbor.test.registry.int.nt-com.ru/proxy-quay"
+    ubuntu_repo: "http://repo.infra.mts/ubuntu/"
-    prometheus_tag: "v3.0.0"
+    image_registry: "harbor.infra.mts/ceph"
-    node_exporter_tag: "v1.8.2"
+    prometheus_tag: "v3.1.0"
+    node_exporter_tag: "v1.5.0"
     grafana_tag: "9.4.12"
     alertmanager_tag: "v0.27.0"
-    ntp_server: "ntp.int.nt-com.ru"
+#    ntp_server: "ntp.int.nt-com.ru"
-    first_mon_ip: "10.50.8.51"
+    first_mon_ip: "10.190.32.78"
 #    cluster_network: "10.63.0.0/24"
     public_network: "10.50.8.0/24"
     CEPH_RELEASE: '19.2.0'
     initial_dashboard_user: 'admin'
     initial_dashboard_password: 'qweqwe'
     allow_fqdn_hostname: 'true'
+#    DNS_address: "10.50.8.51"
   tasks:
     - name: basic setups
       import_tasks:
@@ -28,7 +32,7 @@
       pause:
         prompt: RUN THIS TO BOOTSTRAP THE CLUSTER "cephadm --image harbor.test.registry.int.nt-com.ru/proxy-quay/ceph/ceph:v19.2 bootstrap --mon-ip {{ first_mon_ip }} 
           --initial-dashboard-user {{ initial_dashboard_user }} --initial-dashboard-password {{ initial_dashboard_password }}
-          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf"
+          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf --allow-fqdn-hostname"
       when:
         - cluster_network is undefined
 
@@ -37,20 +41,6 @@
         prompt: RUN THIS TO BOOTSTRAP THE CLUSTER "cephadm --image harbor.test.registry.int.nt-com.ru/proxy-quay/ceph/ceph:v19.2 bootstrap --mon-ip {{ first_mon_ip }} 
           --cluster-network {{ cluster_network }}
           --initial-dashboard-user {{ initial_dashboard_user }} --initial-dashboard-password {{ initial_dashboard_password }}
-          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf"
+          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf --allow-fqdn-hostname"
       when:
         - cluster_network is defined
-
-
-  handlers:
-    - name: ceph-rollout:restart_chrony
-      ansible.builtin.systemd_service:
-        state: restarted
-        name: chronyd
-#      listen: "restart chronyd service"
-    - name: ceph-rollout:restart_sshd
-      ansible.builtin.systemd_service:
-        state: restarted
-        name: sshd
-#      listen: "restart sshd service"
-

rgw.yaml

@@ -11,4 +11,4 @@ spec:
   rgw_zonegroup:
   rgw_frontend_port: 1234
 networks:
-  - 192.169.142.0/24
+  - 10.63.1.0/24

templates/ceph.list.j2

@@ -0,0 +1 @@
+deb [signed-by=/usr/share/keyrings/ceph.gpg] "{{ ceph_repo }}" jammy main

templates/chrony.yaml.j2

@@ -17,11 +17,8 @@ confdir /etc/chrony/conf.d
 # About using servers from the NTP Pool Project in general see (LP: #104525).
 # Approved by Ubuntu Technical Board on 2011-02-08.
 # See http://www.pool.ntp.org/join.html for more information.
-server {{ ntp_server }} iburst prefer
+server {{ ntp_server }} iburst
-#pool ntp.ubuntu.com        iburst maxsources 4
+
-#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
 
 # Use time sources from DHCP.
 sourcedir /run/chrony-dhcp

templates/cluster_spec.yml.j2

@@ -1,5 +1,5 @@
 {% macro nodes() %}
-    {%- for _host in groups['all'] %}
+    {%- for _host in groups['ceph-nodes'] %}
 service_type: host
 addr: {{hostvars[_host]['addr']}}
 hostname: {{ _host }}

templates/initial-ceph.j2

@@ -3,4 +3,3 @@ mgr/cephadm/container_image_prometheus = {{ image_registry }}/prometheus/prometh
 mgr/cephadm/container_image_node_exporter = {{ image_registry }}/prometheus/node-exporter:{{ node_exporter_tag }}
 mgr/cephadm/container_image_grafana = {{ image_registry }}/ceph/ceph-grafana:{{ grafana_tag }}
 mgr/cephadm/container_image_alertmanager = {{ image_registry }}/prometheus/alertmanager:{{ alertmanager_tag }}
-

templates/sources.list.j2

@@ -0,0 +1,42 @@
+# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
+# newer versions of the distribution.
+deb "{{ ubuntu_repo }}" jammy main restricted
+# deb-src "{{ ubuntu_repo }}" jammy main restricted
+
+## Major bug fix updates produced after the final release of the
+## distribution.
+deb "{{ ubuntu_repo }}" jammy-updates main restricted
+# deb-src "{{ ubuntu_repo }}" jammy-updates main restricted
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team. Also, please note that software in universe WILL NOT receive any
+## review or updates from the Ubuntu security team.
+deb "{{ ubuntu_repo }}" jammy universe
+# deb-src "{{ ubuntu_repo }}" jammy universe
+deb "{{ ubuntu_repo }}" jammy-updates universe
+# deb-src "{{ ubuntu_repo }}" jammy-updates universe
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team, and may not be under a free licence. Please satisfy yourself as to
+## your rights to use the software. Also, please note that software in
+## multiverse WILL NOT receive any review or updates from the Ubuntu
+## security team.
+deb "{{ ubuntu_repo }}" jammy multiverse
+# deb-src "{{ ubuntu_repo }}" jammy multiverse
+deb "{{ ubuntu_repo }}" jammy-updates multiverse
+# deb-src "{{ ubuntu_repo }}" jammy-updates multiverse
+
+## N.B. software from this repository may not have been tested as
+## extensively as that contained in the main release, although it includes
+## newer versions of some applications which may provide useful features.
+## Also, please note that software in backports WILL NOT receive any review
+## or updates from the Ubuntu security team.
+deb "{{ ubuntu_repo }}" jammy-backports main restricted universe multiverse
+# deb-src "{{ ubuntu_repo }}" jammy-backports main restricted universe multiverse
+
+#deb http://security.ubuntu.com/ubuntu/ jammy-security main restricted
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security main restricted
+#deb http://security.ubuntu.com/ubuntu/ jammy-security universe
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security universe
+#deb http://security.ubuntu.com/ubuntu/ jammy-security multiverse
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security multiverse

templates/sshd_config.j2

@@ -53,8 +53,9 @@ PermitRootLogin yes
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+PasswordAuthentication yes
 #PermitEmptyPasswords no
+PermitRootLogin yes
 
 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)