Commit 970c6a4e authored by Guillaume Abrioux's avatar Guillaume Abrioux
Browse files

mon: refact initial keyring generation

adding monitor is no longer possible because we generate a new mon
keyring each time the playbook is run.

Fixes: #5864
Signed-off-by: default avatarGuillaume Abrioux <>
parent 5ff2ca27
......@@ -68,6 +68,9 @@
name: ceph-config
- import_role:
name: ceph-mon
- import_role:
name: ceph-crash
when: containerized_deployment | bool
# update config files on OSD nodes
- hosts: osds
......@@ -83,8 +83,9 @@ options:
return a json output.
If 'info' is used, the module will return in a json format the
description of a given keyring.
If 'generate_secret' is used, the module will simply output a cephx keyring.
required: false
choices: ['present', 'update', 'absent', 'list', 'info', 'fetch_initial_keys']
choices: ['present', 'update', 'absent', 'list', 'info', 'fetch_initial_keys', 'generate_secret']
default: present
......@@ -491,7 +492,8 @@ def run_module():
module_args = dict(
cluster=dict(type='str', required=False, default='ceph'),
name=dict(type='str', required=False),
state=dict(type='str', required=False, default='present', choices=['present', 'update', 'absent', 'list', 'info', 'fetch_initial_keys']),
state=dict(type='str', required=False, default='present', choices=['present', 'update', 'absent',
'list', 'info', 'fetch_initial_keys', 'generate_secret']),
caps=dict(type='dict', required=False, default=None),
secret=dict(type='str', required=False, default=None, no_log=True),
import_key=dict(type='bool', required=False, default=True),
......@@ -677,9 +679,12 @@ def run_module():
file_args = module.load_file_common_arguments(module.params)
file_args['path'] = key_path
module.set_fs_attributes_if_different(file_args, False)
msg='State must either be "present" or "absent" or "list" or "info" or "fetch_initial_keys".', changed=False, rc=1) # noqa E501
elif state == "generate_secret":
out = generate_secret().decode()
cmd = ''
rc = 0
err = ''
changed = True
endd =
delta = endd - startd
......@@ -4,7 +4,7 @@
name: mon.
cluster: "{{ cluster }}"
user: mon.
user_key: "/var/lib/ceph/mon/{{ cluster }}-{{ hostvars[groups[mon_group_name][0] if running_mon is undefined else running_mon]['ansible_hostname'] }}/keyring"
user_key: "/var/lib/ceph/mon/{{ cluster }}-{{ hostvars[running_mon]['ansible_hostname'] }}/keyring"
output_format: json
state: info
......@@ -12,26 +12,21 @@
CEPH_CONTAINER_BINARY: "{{ container_binary }}"
register: initial_mon_key
run_once: True
delegate_to: "{{ groups[mon_group_name][0] if running_mon is undefined else running_mon }}"
when: ceph_current_status.fsid is defined
delegate_to: "{{ running_mon }}"
when: running_mon is defined
- name: generate monitor initial keyring
command: >
{{ hostvars[groups[mon_group_name][0] if running_mon is undefined else running_mon]['discovered_interpreter_python'] }} -c "import os ; import struct ;
import time; import base64 ; key = os.urandom(16) ;
header = struct.pack('<hiih',1,int(time.time()),0,len(key)) ;
print(base64.b64encode(header + key).decode())"
state: generate_secret
register: monitor_keyring
run_once: True
delegate_to: "{{ groups[mon_group_name][0] if running_mon is undefined else running_mon }}"
delegate_to: localhost
run_once: true
- initial_mon_key.skipped is defined
- ceph_current_status.fsid is undefined
- name: get initial keyring when it already exists
monitor_keyring: "{{ (initial_mon_key.stdout | from_json)[0].key if monitor_keyring.skipped is defined else monitor_keyring.stdout if initial_mon_key.skipped is defined }}"
when: initial_mon_key is not skipped or monitor_keyring is not skipped
monitor_keyring: "{{ (initial_mon_key.stdout | from_json)[0]['key'] if initial_mon_key is not skipped else monitor_keyring.stdout }}"
- name: create monitor initial keyring
......@@ -565,3 +565,15 @@ class TestCephKeyModule(object):
result = result.value.args[0]
assert result['msg'] == 'value of output_format must be one of: json, plain, xml, yaml, got: {}'.format(invalid_format)
def test_generate_key(self, m_exit_json, m_generate_secret):
fake_secret = b'AQDaLb1fAAAAABAAsIMKdGEKu+lGOyXnRfT0Hg=='
ca_test_common.set_module_args({"state": "generate_secret"})
m_exit_json.side_effect = ca_test_common.exit_json
m_generate_secret.return_value = fake_secret
with pytest.raises(ca_test_common.AnsibleExitJson) as result:
assert result.value.args[0]['stdout'] == fake_secret.decode()
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment