updated image of vaultwarden from 1.30.1 to 1.32.7

basics.yaml

@@ -0,0 +1,79 @@
+    - name: set FQDN
+      hostname:
+        name: "{{ inventory_hostname }}"
+        use: systemd
+
+    - name: set root password
+      ansible.builtin.user:
+        name: root
+        password: "{{ root_pass | password_hash('sha512')}}"
+
+    - name: set date and time manually to be able to interact with repo=
+      command: "{{ item }}"
+      loop:
+        - date -s "{{ now(utc=true,fmt='%Y-%m-%d %H:%M:%S') }}"
+        - hwclock --systohc
+
+    - import_role:
+        name: ansible-netplan
+
+    - name: update repos sources|sshd_config|repo_key
+      ansible.builtin.copy:
+        src: "{{ item.name }}"
+        dest: "{{ item.dest }}"
+      loop:
+        - {name: ceph.list,dest: /etc/apt/sources.list.d/ceph.list}
+        - {name: sshd_config,dest: /etc/ssh/sshd_config}
+        - {name: ceph.gpg,dest: /usr/share/keyrings/ceph.gpg}
+
+    - name: Templating sources lists
+      ansible.builtin.template:
+        src: "{{ item.name }}"
+        dest: "{{ item.dest }}"
+      loop:
+        - { name: sources.list.j2,dest: /etc/apt/sources.list }
+        - { name: ceph.list.j2,dest: /etc/apt/sources.list.d/ceph.list }
+
+    - name: install packages
+      apt:
+        pkg:
+          - ceph-common
+          - cephadm
+          - lvm2
+          - podman
+          - chrony
+          - mc
+          - linux-tools-common
+          - linux-tools-`uname -r`
+          - ipmitool
+        state: present
+        update_cache: yes
+
+    - name: Setup ntp client
+      template:
+        src: chrony.yaml.j2
+        dest: /etc/chrony/chrony.conf
+
+    - name: setup ipmi
+      import_role:
+        name: ansible-ipmitool
+
+    - name: Templating cluster settings files
+      template:
+        src:  "{{ item.name }}"
+        dest: "{{ item.dest }}"
+        trim_blocks: true
+        lstrip_blocks: true
+      loop:
+        - { name: "cluster_spec.yml.j2", dest: "/root/cluster_spec.yml" }
+        - { name: "initial-ceph.j2", dest: "/root/initial-ceph.conf" }
+      run_once: true
+      delegate_to: "{{ ansible_play_hosts[0] }}"
+
+    - name: restart_services
+      ansible.builtin.systemd:
+        state: restarted
+        name: "{{ item }}"
+      loop:
+        - sshd
+        - chronyd

gprs_szfo.yaml

@@ -0,0 +1,17 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.szfo:
+      ansible_host: 10.50.8.88
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.szfo:
+      ansible_host: 10.50.8.89
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.szfo:
+      ansible_host: 10.50.8.90
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345

grafana.yaml

@@ -0,0 +1,3 @@
+service_type: grafana
+spec:
+  initial_admin_password: qweqwe

host_vars/node01.gprs.ceph.cfo

@@ -0,0 +1,7 @@
+addr: 10.50.8.88
+location:
+  root: default
+labels:
+  - mon
+  - osd
+  - mgr

host_vars/node01.gprs.ceph.cfo.bkp

@@ -0,0 +1,7 @@
+addr: 10.50.8.97
+location:
+  root: default
+labels:
+  - mon
+  - osd
+  - mgr

host_vars/node01.gprs.ceph.szfo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.88
+location:
+  root: default
+labels:
+  - mon
+  - osd
+  - mgr

host_vars/node01.gprs.ceph.ufo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.75
+location:
+  root: default
+labels:
+  - mon
+  - osd
+  - mgr

host_vars/node02.gprs.ceph.cfo

@@ -0,0 +1,5 @@
+addr: 10.50.8.89
+location:
+  root: default
+labels:
+  - osd

host_vars/node02.gprs.ceph.cfo.bkp

@@ -0,0 +1,5 @@
+addr: 10.50.8.98
+location:
+  root: default
+labels:
+  - osd

host_vars/node02.gprs.ceph.szfo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.89
+location:
+  root: default
+labels:
+#  - mon
+  - osd
+#  - mgr

host_vars/node02.gprs.ceph.ufo.yaml

@@ -0,0 +1,7 @@
+addr: 10.50.8.76
+location:
+  root: default
+labels:
+#  - mon
+  - osd
+#  - mgr

host_vars/node03.gprs.ceph.cfo

@@ -0,0 +1,5 @@
+addr: 10.50.8.90
+location:
+  root: default
+labels:
+  - osd

host_vars/node03.gprs.ceph.cfo.bkp

@@ -0,0 +1,5 @@
+addr: 10.50.8.99
+location:
+  root: default
+labels:
+  - osd

host_vars/node03.gprs.ceph.szfo.yaml

@@ -0,0 +1,6 @@
+addr: 10.50.8.90
+location:
+  root: default
+labels:
+#  - mon
+  - osd

host_vars/node03.gprs.ceph.ufo.yaml

@@ -0,0 +1,6 @@
+addr: 10.50.8.77
+location:
+  root: default
+labels:
+#  - mon
+  - osd

ingress.yaml

@@ -0,0 +1,12 @@
+service_type: ingress
+service_id: rgw.ingress
+placement:
+  hosts:
+    - ceph01
+    - ceph03
+spec:
+  backend_service: rgw.test
+  virtual_ip: 10.63.1.100/24
+  frontend_port: 80
+  monitor_port: 1967
+  virtual_interface_networks: 10.63.1.0/24

inv.yaml

@@ -1,17 +1,22 @@
 ceph-nodes:
   hosts:
-    ceph01:
+    node01.gprs.ceph.ufo:
-      ansible_host: 10.50.42.23
+      ansible_host: 10.50.8.75
-      ansible_user: mgr
+      ansible_user: g10
       ansible_ssh_pass: 12345
       ansible_become_pass: 12345
-    ceph02:
+    node02.gprs.ceph.ufo:
-      ansible_host: 10.50.42.24
+      ansible_host: 10.50.8.76
-      ansible_user: mgr
+      ansible_user: g10
       ansible_ssh_pass: 12345
       ansible_become_pass: 12345
-    ceph03:
+    node03.gprs.ceph.ufo:
-      ansible_host: 10.50.42.25
+      ansible_host: 10.50.8.77
-      ansible_user: mgr
+      ansible_user: g10
       ansible_ssh_pass: 12345
       ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

multi-1st.yaml

@@ -0,0 +1,22 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.cfo:
+      ansible_host: 10.50.8.88
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.cfo:
+      ansible_host: 10.50.8.89
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.cfo:
+      ansible_host: 10.50.8.90
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

multi-2nd.yaml

@@ -0,0 +1,22 @@
+ceph-nodes:
+  hosts:
+    node01.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.97
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node02.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.98
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+    node03.gprs.ceph.cfo.bkp:
+      ansible_host: 10.50.8.99
+      ansible_user: g10
+      ansible_ssh_pass: 12345
+      ansible_become_pass: 12345
+#    ceph-client:
+#      ansible_host: 10.50.8.91
+#      ansible_user: g10
+#      ansible_ssh_pass: 12345
+#      ansible_become_pass: 12345

pre-deploy.yml

@@ -4,16 +4,43 @@
   become: true
   gather_facts: true
   diff: true
+  vars_files:
+    - pass.yaml #encrypted pass for root
   vars:
-    ceph_repo: "https://download.ceph.com/debian-squid"
+    ceph_repo: "http://repo.infra.mts/debian-squid"
+    ubuntu_repo: "http://repo.infra.mts/ubuntu/"
+    image_registry: "harbor.infra.mts/ceph"
+    prometheus_tag: "v3.1.0"
+    node_exporter_tag: "v1.5.0"
+    grafana_tag: "9.4.12"
+    alertmanager_tag: "v0.27.0"
+#    ntp_server: "ntp.int.nt-com.ru"
+    first_mon_ip: "10.190.32.78"
+#    cluster_network: "10.63.0.0/24"
+    public_network: "10.50.8.0/24"
+    CEPH_RELEASE: '19.2.0'
+    initial_dashboard_user: 'admin'
+    initial_dashboard_password: 'qweqwe'
+    allow_fqdn_hostname: 'true'
+#    DNS_address: "10.50.8.51"
   tasks:
-    - name: get gpg key and import it
+    - name: basic setups
-      command:
+      import_tasks:
-        chdir: /tmp
+        file: basics.yaml
-        cmd: >
+
-          wget -q -O 'https://download.ceph.com/keys/release.asc';
+    - name: running ceph bootstrap
-          gpg -o /user/share/keyrings/ceph.gpg --dearmor release.asc;
+      pause:
-    - name: Add ceph repo
+        prompt: RUN THIS TO BOOTSTRAP THE CLUSTER "cephadm --image harbor.test.registry.int.nt-com.ru/proxy-quay/ceph/ceph:v19.2 bootstrap --mon-ip {{ first_mon_ip }} 
-      apt_repository:
+          --initial-dashboard-user {{ initial_dashboard_user }} --initial-dashboard-password {{ initial_dashboard_password }}
-        repo: "deb [/usr/share/keyrings/ceph.gpg] {{ ceph-repo }} {{ ansible_distribution_release }} main"
+          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf --allow-fqdn-hostname"
-        state: present
+      when:
+        - cluster_network is undefined
+
+    - name: running ceph bootstrap
+      pause:
+        prompt: RUN THIS TO BOOTSTRAP THE CLUSTER "cephadm --image harbor.test.registry.int.nt-com.ru/proxy-quay/ceph/ceph:v19.2 bootstrap --mon-ip {{ first_mon_ip }} 
+          --cluster-network {{ cluster_network }}
+          --initial-dashboard-user {{ initial_dashboard_user }} --initial-dashboard-password {{ initial_dashboard_password }}
+          --apply-spec /root/cluster_spec.yml --config /root/initial-ceph.conf --allow-fqdn-hostname"
+      when:
+        - cluster_network is defined

rgw.yaml

@@ -0,0 +1,14 @@
+service_type: rgw
+service_id: rgw_test
+placement:
+  hosts:
+  - ceph01
+  - ceph03
+  count_per_host: 1
+spec:
+  rgw_realm: norsi
+  rgw_zone: savela
+  rgw_zonegroup:
+  rgw_frontend_port: 1234
+networks:
+  - 10.63.1.0/24

templates/ceph.conf.j2

@@ -0,0 +1,5 @@
+[global]
+public_network = {{ public_network }}
+{% if cluster_network is defined -%}
+    cluster_network = {{ cluster_network }}
+{% endif %}

templates/ceph.list.j2

@@ -0,0 +1 @@
+deb [signed-by=/usr/share/keyrings/ceph.gpg] "{{ ceph_repo }}" jammy main

templates/chrony.yaml.j2

@@ -0,0 +1,60 @@
+# Welcome to the chrony configuration file. See chrony.conf(5) for more
+# information about usable directives.
+
+# Include configuration files found in /etc/chrony/conf.d.
+confdir /etc/chrony/conf.d
+
+# This will use (up to):
+# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
+# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
+# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
+# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
+# sources will be used.
+# At the same time it retains some protection against one of the entries being
+# down (compare to just using one of the lines). See (LP: #1754358) for the
+# discussion.
+#
+# About using servers from the NTP Pool Project in general see (LP: #104525).
+# Approved by Ubuntu Technical Board on 2011-02-08.
+# See http://www.pool.ntp.org/join.html for more information.
+server {{ ntp_server }} iburst
+
+
+# Use time sources from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Use NTP sources found in /etc/chrony/sources.d.
+sourcedir /etc/chrony/sources.d
+
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/chrony.drift
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
+rtcsync
+
+# Step the system clock instead of slewing it if the adjustment is larger than
+# one second, but only in the first three clock updates.
+makestep 1 3
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+# This directive must be commented out when using time sources serving
+# leap-smeared time.
+leapsectz right/UTC

templates/cluster_spec.yml.j2

@@ -0,0 +1,34 @@
+{% macro nodes() %}
+    {%- for _host in groups['ceph-nodes'] %}
+service_type: host
+addr: {{hostvars[_host]['addr']}}
+hostname: {{ _host }}
+location:
+    {% for key, value in hostvars[_host]['location'].items() %}
+    {{key}}: {{value}}
+    {% endfor %}
+labels:
+    {% for i in hostvars[_host]['labels']%}
+    - {{ i }}
+    {% endfor %}
+---
+    {% endfor %}
+{% endmacro %}
+{{ nodes() }}
+service_type: mon
+placement:
+  label: "mon"
+---
+service_type: mgr
+service_name: mgr
+placement:
+  label: "mgr"
+---
+service_type: osd
+service_id: All_disks
+service_name: osd.all-available-devices
+placement:
+  label: "osd"
+spec:
+  data_devices:
+    all: true

templates/initial-ceph.j2

@@ -0,0 +1,5 @@
+[mgr]
+mgr/cephadm/container_image_prometheus = {{ image_registry }}/prometheus/prometheus:{{ prometheus_tag }}
+mgr/cephadm/container_image_node_exporter = {{ image_registry }}/prometheus/node-exporter:{{ node_exporter_tag }}
+mgr/cephadm/container_image_grafana = {{ image_registry }}/ceph/ceph-grafana:{{ grafana_tag }}
+mgr/cephadm/container_image_alertmanager = {{ image_registry }}/prometheus/alertmanager:{{ alertmanager_tag }}

templates/sources.list.j2

@@ -0,0 +1,42 @@
+# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
+# newer versions of the distribution.
+deb "{{ ubuntu_repo }}" jammy main restricted
+# deb-src "{{ ubuntu_repo }}" jammy main restricted
+
+## Major bug fix updates produced after the final release of the
+## distribution.
+deb "{{ ubuntu_repo }}" jammy-updates main restricted
+# deb-src "{{ ubuntu_repo }}" jammy-updates main restricted
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team. Also, please note that software in universe WILL NOT receive any
+## review or updates from the Ubuntu security team.
+deb "{{ ubuntu_repo }}" jammy universe
+# deb-src "{{ ubuntu_repo }}" jammy universe
+deb "{{ ubuntu_repo }}" jammy-updates universe
+# deb-src "{{ ubuntu_repo }}" jammy-updates universe
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team, and may not be under a free licence. Please satisfy yourself as to
+## your rights to use the software. Also, please note that software in
+## multiverse WILL NOT receive any review or updates from the Ubuntu
+## security team.
+deb "{{ ubuntu_repo }}" jammy multiverse
+# deb-src "{{ ubuntu_repo }}" jammy multiverse
+deb "{{ ubuntu_repo }}" jammy-updates multiverse
+# deb-src "{{ ubuntu_repo }}" jammy-updates multiverse
+
+## N.B. software from this repository may not have been tested as
+## extensively as that contained in the main release, although it includes
+## newer versions of some applications which may provide useful features.
+## Also, please note that software in backports WILL NOT receive any review
+## or updates from the Ubuntu security team.
+deb "{{ ubuntu_repo }}" jammy-backports main restricted universe multiverse
+# deb-src "{{ ubuntu_repo }}" jammy-backports main restricted universe multiverse
+
+#deb http://security.ubuntu.com/ubuntu/ jammy-security main restricted
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security main restricted
+#deb http://security.ubuntu.com/ubuntu/ jammy-security universe
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security universe
+#deb http://security.ubuntu.com/ubuntu/ jammy-security multiverse
+# deb-src http://security.ubuntu.com/ubuntu/ jammy-security multiverse

templates/sshd_config.j2

@@ -0,0 +1,122 @@
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+Include /etc/ssh/sshd_config.d/*.conf
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication yes
+#PermitEmptyPasswords no
+PermitRootLogin yes
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+KbdInteractiveAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       PermitTTY no
+#       ForceCommand cvs server