]> git.apps.os.sepia.ceph.com Git - ceph-ansible.git/commit
ceph-mon: Don't set monitor directory mode recursively
authorBenoît Knecht <bknecht@protonmail.ch>
Wed, 28 Oct 2020 15:09:58 +0000 (16:09 +0100)
committerGuillaume Abrioux <gabrioux@redhat.com>
Mon, 2 Nov 2020 16:36:37 +0000 (17:36 +0100)
commit0d76826bbb7b0b9303583c31147ebad9e5c420f9
tree970081b650ab22790da525762c4b21f3b283df62
parent2138a00a3294b222d5e8325495300841ed5a7f5f
ceph-mon: Don't set monitor directory mode recursively

After rolling updates performed with
`infrastructure-playbooks/rolling_updates.yml`, files located in
`/var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}` had mode 0755 (including
the keyring), making them world-readable.

This commit separates the task that configured permissions recursively on
`/var/lib/ceph/mon/{{ cluster }}-{{ monitor_name }}` into two separate tasks:

1. Set the ownership and mode of the directory itself;
2. Recursively set ownership in the directory, but don't modify the mode.

Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
roles/ceph-mon/tasks/deploy_monitors.yml