fdf2385f14
This patch is adding a feature for an option to copy different
ceph configuration files and corresponding keyrings for cinder,
glance, manila, gnocchi and nova services.
This is especially useful when the deployment uses availability
zones as below example.
- Individual compute can read/write to individual ceph
cluster in same AZ.
- Cinder can write to several ceph clusters in several AZs.
- Glance can use multistore and upload images to
several ceph clusters in several AZs at once.
Change-Id: Ie4d8ab5a3df748137835cae1c943b9180cd10eb1
212 lines
7.1 KiB
YAML
212 lines
7.1 KiB
YAML
---
|
|
- name: Check nova keyring file
|
|
vars:
|
|
keyring: "{{ nova_ceph_cluster }}.{{ ceph_nova_keyring }}"
|
|
paths:
|
|
- "{{ node_custom_config }}/nova/{{ inventory_hostname }}/{{ keyring }}"
|
|
- "{{ node_custom_config }}/nova/{{ keyring }}"
|
|
stat:
|
|
path: "{{ lookup('first_found', paths) }}"
|
|
delegate_to: localhost
|
|
register: nova_cephx_keyring_file
|
|
failed_when: not nova_cephx_keyring_file.stat.exists
|
|
when:
|
|
- nova_backend == "rbd"
|
|
- external_ceph_cephx_enabled | bool
|
|
|
|
- name: Check cinder keyring file
|
|
vars:
|
|
keyring: "{{ nova_ceph_cluster }}.{{ ceph_cinder_keyring }}"
|
|
paths:
|
|
- "{{ node_custom_config }}/nova/{{ inventory_hostname }}/{{ keyring }}"
|
|
- "{{ node_custom_config }}/nova/{{ keyring }}"
|
|
stat:
|
|
path: "{{ lookup('first_found', paths) }}"
|
|
delegate_to: localhost
|
|
register: cinder_cephx_keyring_file
|
|
failed_when: not cinder_cephx_keyring_file.stat.exists
|
|
when:
|
|
- cinder_backend_ceph | bool
|
|
- external_ceph_cephx_enabled | bool
|
|
|
|
- name: Extract nova key from file
|
|
set_fact:
|
|
nova_cephx_raw_key:
|
|
"{{ lookup('template', nova_cephx_keyring_file.stat.path) | regex_search('key\\s*=.*$', multiline=True) | regex_replace('key\\s*=\\s*(.*)\\s*', '\\1') }}"
|
|
changed_when: false
|
|
when:
|
|
- nova_backend == "rbd"
|
|
- external_ceph_cephx_enabled | bool
|
|
|
|
- name: Extract cinder key from file
|
|
set_fact:
|
|
cinder_cephx_raw_key:
|
|
"{{ lookup('file', cinder_cephx_keyring_file.stat.path) | regex_search('key\\s*=.*$', multiline=True) | regex_replace('key\\s*=\\s*(.*)\\s*', '\\1') }}"
|
|
changed_when: false
|
|
when:
|
|
- cinder_backend_ceph | bool
|
|
- external_ceph_cephx_enabled | bool
|
|
|
|
- name: Copy over ceph nova keyring file
|
|
template:
|
|
src: "{{ nova_cephx_keyring_file.stat.path }}"
|
|
dest: "{{ node_config_directory }}/{{ item }}/"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0660"
|
|
become: true
|
|
with_items:
|
|
- nova-compute
|
|
when:
|
|
- inventory_hostname in groups[nova_cell_compute_group]
|
|
- nova_backend == "rbd"
|
|
- external_ceph_cephx_enabled | bool
|
|
notify:
|
|
- Restart {{ item }} container
|
|
|
|
- name: Copy over ceph cinder keyring file
|
|
template:
|
|
src: "{{ cinder_cephx_keyring_file.stat.path }}"
|
|
dest: "{{ node_config_directory }}/{{ item }}/"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0660"
|
|
become: true
|
|
with_items: # NOTE: nova-libvirt does not need it
|
|
- nova-compute
|
|
when:
|
|
- inventory_hostname in groups[nova_cell_compute_group]
|
|
- nova_backend == "rbd"
|
|
- external_ceph_cephx_enabled | bool
|
|
notify:
|
|
- Restart {{ item }} container
|
|
|
|
- name: Copy over ceph.conf
|
|
vars:
|
|
service: "{{ nova_cell_services[item] }}"
|
|
paths:
|
|
- "{{ node_custom_config }}/nova/{{ inventory_hostname }}/{{ nova_ceph_cluster }}.conf"
|
|
- "{{ node_custom_config }}/nova/{{ nova_ceph_cluster }}.conf"
|
|
template:
|
|
src: "{{ lookup('first_found', paths) }}"
|
|
dest: "{{ node_config_directory }}/{{ item }}/"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0660"
|
|
become: true
|
|
with_items:
|
|
- nova-compute
|
|
- nova-libvirt
|
|
when:
|
|
- inventory_hostname in groups[service.group]
|
|
- service.enabled | bool
|
|
- nova_backend == "rbd"
|
|
notify:
|
|
- Restart {{ item }} container
|
|
|
|
- block:
|
|
- name: Ensure /etc/ceph directory exists (host libvirt)
|
|
vars:
|
|
paths:
|
|
- "{{ node_custom_config }}/nova/{{ inventory_hostname }}/{{ nova_ceph_cluster }}.conf"
|
|
- "{{ node_custom_config }}/nova/{{ nova_ceph_cluster }}.conf"
|
|
file:
|
|
path: "/etc/ceph/"
|
|
state: "directory"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
become: true
|
|
|
|
- name: Copy over ceph.conf (host libvirt)
|
|
vars:
|
|
paths:
|
|
- "{{ node_custom_config }}/nova/{{ inventory_hostname }}/{{ nova_ceph_cluster }}.conf"
|
|
- "{{ node_custom_config }}/nova/{{ nova_ceph_cluster }}.conf"
|
|
template:
|
|
src: "{{ lookup('first_found', paths) }}"
|
|
dest: "/etc/ceph/{{ nova_ceph_cluster }}.conf"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0644"
|
|
become: true
|
|
when:
|
|
- not enable_nova_libvirt_container | bool
|
|
- inventory_hostname in groups[nova_cell_compute_group]
|
|
- nova_backend == "rbd"
|
|
|
|
- block:
|
|
- name: Ensuring libvirt secrets directory exists
|
|
vars:
|
|
service: "{{ nova_cell_services['nova-libvirt'] }}"
|
|
file:
|
|
path: "{{ libvirt_secrets_dir }}"
|
|
state: "directory"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0770"
|
|
become: true
|
|
when:
|
|
- inventory_hostname in groups[service.group]
|
|
|
|
- name: Pushing nova secret xml for libvirt
|
|
vars:
|
|
service: "{{ nova_cell_services['nova-libvirt'] }}"
|
|
template:
|
|
src: "secret.xml.j2"
|
|
dest: "{{ libvirt_secrets_dir }}/{{ item.uuid }}.xml"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0600"
|
|
become: true
|
|
when:
|
|
- inventory_hostname in groups[service.group]
|
|
- item.enabled | bool
|
|
with_items:
|
|
- uuid: "{{ rbd_secret_uuid }}"
|
|
name: "client.nova secret"
|
|
enabled: "{{ nova_backend == 'rbd' }}"
|
|
- uuid: "{{ cinder_rbd_secret_uuid }}"
|
|
name: "client.cinder secret"
|
|
enabled: "{{ cinder_backend_ceph }}"
|
|
notify: "{{ libvirt_restart_handlers }}"
|
|
|
|
- name: Pushing secrets key for libvirt
|
|
vars:
|
|
service: "{{ nova_cell_services['nova-libvirt'] }}"
|
|
template:
|
|
src: "libvirt-secret.j2"
|
|
dest: "{{ libvirt_secrets_dir }}/{{ item.uuid }}.base64"
|
|
owner: "{{ config_owner_user }}"
|
|
group: "{{ config_owner_group }}"
|
|
mode: "0600"
|
|
become: true
|
|
when:
|
|
- inventory_hostname in groups[service.group]
|
|
- item.enabled | bool
|
|
- external_ceph_cephx_enabled | bool
|
|
with_items:
|
|
# NOTE(yoctozepto): 'default' filter required due to eager evaluation of item content
|
|
# which will be undefined if the applicable condition is False
|
|
- uuid: "{{ rbd_secret_uuid }}"
|
|
result: "{{ nova_cephx_raw_key | default }}"
|
|
enabled: "{{ nova_backend == 'rbd' }}"
|
|
- uuid: "{{ cinder_rbd_secret_uuid }}"
|
|
result: "{{ cinder_cephx_raw_key | default }}"
|
|
enabled: "{{ cinder_backend_ceph }}"
|
|
notify: "{{ libvirt_restart_handlers }}"
|
|
no_log: True
|
|
vars:
|
|
libvirt_secrets_dir: >-
|
|
{{ (node_config_directory ~ '/nova-libvirt/secrets')
|
|
if enable_nova_libvirt_container | bool
|
|
else '/etc/libvirt/secrets' }}
|
|
# NOTE(mgoddard): When running libvirt as a host daemon, on CentOS it
|
|
# appears to pick up secrets automatically, while on Ubuntu it requires a
|
|
# reload. This may be due to differences in tested versions of libvirt
|
|
# (8.0.0 vs 6.0.0). Reload should be low overhead, so do it always.
|
|
libvirt_restart_handlers: >-
|
|
{{ ['Restart nova-libvirt container']
|
|
if enable_nova_libvirt_container | bool else
|
|
['Reload libvirtd'] }}
|