qa: check health warnings in cephx upgrade

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>

diff --git a/qa/suites/rados/upgrade/cephx/X/conf.yaml b/qa/suites/rados/upgrade/cephx/X/conf.yaml
index cdae16430079b8507b16d4cb7a6ea25c88d0414d..895c6b1ee9105f6b0086ad5e3a9c126afd37fd67 100644 (file)
--- a/qa/suites/rados/upgrade/cephx/X/conf.yaml
+++ b/qa/suites/rados/upgrade/cephx/X/conf.yaml
@@ -10,4 +10,5 @@ overrides:
         auth service ticket ttl: 120
       mon:
         debug mon: 30
+        debug paxos: 30
         debug ms: 5

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/0-install.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/0-install.yaml
deleted file mode 100644 (file)
index e6f4644..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/0-install.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-tasks:
-- install:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/00-install.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/00-install.yaml
new file mode 100644 (file)
index 0000000..e6f4644
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/00-install.yaml
@@ -0,0 +1,2 @@
+tasks:
+- install:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/01-ceph.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/01-ceph.yaml
new file mode 100644 (file)
index 0000000..8ba1c32
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/01-ceph.yaml
@@ -0,0 +1,32 @@
+tasks:
+- ceph:
+    log-ignorelist:
+      - AUTH_INSECURE_KEYS_ALLOWED
+      - AUTH_INSECURE_KEYS_CREATABLE
+      - AUTH_INSECURE_SERVICE_TICKETS
+      - AUTH_INSECURE_CLIENT_KEY_TYPE
+      - AUTH_INSECURE_SERVICE_KEY_TYPE
+      - AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+    conf:
+      mon:
+        mon_health_to_clog: false
+    cluster-conf:
+      mon:
+        mon auth allow insecure key: true
+    monmaptool_extra_args:
+      - '--auth-service-cipher=aes'
+      - '--auth-allowed-ciphers=aes'
+      - '--auth-preferred-cipher=aes'
+    cephx:
+      key_type: aes
+    wait-for-healthy: false
+- ceph.key_prune: ["client.bootstrap-*"]
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_ALLOWED --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_CREATABLE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_SERVICE_TICKETS --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_CLIENT_KEY_TYPE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_SERVICE_KEY_TYPE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE --sticky
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/02-debug.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/02-debug.yaml
new file mode 100644 (file)
index 0000000..bc8afd8
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/02-debug.yaml
@@ -0,0 +1,14 @@
+tasks:
+- full_sequential_finally:
+  - exec:
+      mon.a:
+        - sleep 1m
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/none.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/none.yaml
new file mode 100644 (file)
index 0000000..a4cbcfe
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/none.yaml
@@ -0,0 +1,3 @@
+teuthology:
+  variables:
+    workload: none

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/radosbench.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/radosbench.yaml
new file mode 100644 (file)
index 0000000..f75bc09
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/03-workload/radosbench.yaml
@@ -0,0 +1,15 @@
+teuthology:
+  variables:
+    workload: radosbench
+
+radosbench:
+  sequential_yield:
+    - radosbench:
+        extra_args: --log-to-stderr=false --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
+        clients: [client.0]
+        time: 900
+        unique_pool: true
+
+tasks:
+  - sequential_yield:
+      - radosbench

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/04-allow-aes256k.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/04-allow-aes256k.yaml
new file mode 100644 (file)
index 0000000..fe4f9a7
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/04-allow-aes256k.yaml
@@ -0,0 +1,10 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 1 or .entity.type == 2 or .entity.type == 4 or .entity.type == 16); .auth.key.type == 1)'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_allowed_ciphers aes,aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_preferred_cipher aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/05-service-auth-keys.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/05-service-auth-keys.yaml
new file mode 100644 (file)
index 0000000..94e5bb5
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/05-service-auth-keys.yaml
@@ -0,0 +1,20 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_SERVICE_KEY_TYPE]
+- ceph.key_rotate:
+    daemons: [mon.*]
+    key_type: aes256k
+- ceph.key_rotate:
+    daemons: [mgr.*, osd.*, mds.*]
+    key_type: aes256k
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 1 or .entity.type == 2 or .entity.type == 4 or .entity.type == 16); .auth.key.type == 2)'
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/06-insecure-create.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/06-insecure-create.yaml
new file mode 100644 (file)
index 0000000..48386c2
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/06-insecure-create.yaml
@@ -0,0 +1,25 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_CREATABLE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_KEYS_CREATABLE]
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config rm mon 'mon auth allow insecure key'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+# The default when auth_allow_ciphers inclues aes, retain default mon_auth_allow_insecure_key=true
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_KEYS_CREATABLE]
+# Now setting it overrides:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config set mon 'mon auth allow insecure key' false
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/admin.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/admin.yaml
new file mode 100644 (file)
index 0000000..2372afc
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/admin.yaml
@@ -0,0 +1,34 @@
+teuthology:
+  variables:
+    clients_all_rotated: false
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.workload == 'none' then
+        reject()
+      end
+
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_CLIENT_KEY_TYPE
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_CLIENT_KEY_TYPE]
+  - ceph.key_rotate:
+      daemons: []
+      clients: [client.admin]
+      key_type: aes256k
+  - exec:
+      mon.a:
+        - |
+          ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys | \
+          jq '
+            .data.secrets[] |
+            select(
+              .entity.type_str == "client" and .entity.id == "admin"
+            ) | .auth.key.type == 2
+          '
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_CLIENT_KEY_TYPE --sticky
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/all.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/all.yaml
new file mode 100644 (file)
index 0000000..91a450a
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/07-client-auth-keys/all.yaml
@@ -0,0 +1,28 @@
+# N.B. we can only rotate all keys if we do not have an existing workload.
+
+teuthology:
+  variables:
+    clients_all_rotated: true
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.workload ~= 'none' then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_CLIENT_KEY_TYPE
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_CLIENT_KEY_TYPE]
+  - ceph.key_rotate:
+      daemons: []
+      clients: [all]
+      key_type: aes256k
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 8); .auth.key.type == 2)'
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/aes256k.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/aes256k.yaml
new file mode 100644 (file)
index 0000000..fb24438
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/aes256k.yaml
@@ -0,0 +1,19 @@
+teuthology:
+  postmerge:
+    - | 
+      if not yaml.teuthology.variables.clients_all_rotated then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_ALLOWED
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_KEYS_ALLOWED]
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_allowed_ciphers aes256k
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/insecure.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/insecure.yaml
new file mode 100644 (file)
index 0000000..05bc48f
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/08-allowed-ciphers/insecure.yaml
@@ -0,0 +1,19 @@
+teuthology:
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.clients_all_rotated then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_ALLOWED
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_KEYS_ALLOWED]
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump --format=json | jq '.auth_allowed_ciphers | (map(.name) | sort) == ["aes", "aes256k"]'
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_ALLOWED --sticky
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/09-cephx-service-upgrade.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/09-cephx-service-upgrade.yaml
new file mode 100644 (file)
index 0000000..dafc6d7
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/09-cephx-service-upgrade.yaml
@@ -0,0 +1,10 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq '.data.rotating_secrets | all( .secrets.keys | all(.expiring_key.key.type == 1) )'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_service_cipher aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/1-ceph.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/1-ceph.yaml
deleted file mode 100644 (file)
index da3d0fc..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/1-ceph.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-tasks:
-- ceph:
-    cluster-conf:
-      global:
-        auth service cipher: aes
-      mon:
-        mon auth allow insecure key: true
-    cephx:
-      key_type: aes

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/no.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/no.yaml
new file mode 100644 (file)
index 0000000..2290d55
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/no.yaml
@@ -0,0 +1,3 @@
+teuthology:
+  variables:
+    wipe_service_keys: false

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/sleep.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/sleep.yaml
new file mode 100644 (file)
index 0000000..d6956ca
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/sleep.yaml
@@ -0,0 +1,11 @@
+# Sleep for ticket refresh.
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE]
+- sleep:
+    duration: 720
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/yes.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/yes.yaml
new file mode 100644 (file)
index 0000000..001a6d1
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/10-wipe-service-keys/yes.yaml
@@ -0,0 +1,14 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE]
+- exec:
+    mon.a:
+      - ceph auth wipe-rotating-service-keys
+      - ceph auth --format=json-pretty dump-keys
+      - ceph auth --format=json dump-keys | jq '.data.rotating_secrets | all(  if .entity.type == 32 then  (.secrets.keys | all(.expiring_key.key.type == 1)) else (.secrets.keys | all(.expiring_key.key.type == 2))  end  )'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_SERVICE_TICKETS
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/no.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/no.yaml
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/yes.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/yes.yaml
new file mode 100644 (file)
index 0000000..56c7271
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/11-daemon-restart/yes.yaml
@@ -0,0 +1,25 @@
+overrides:
+  ceph:
+    log-ignorelist:
+      - OSD_DOWN
+      - OSD_ROOT_DOWN
+tasks:
+- sleep:
+    duration: 10
+- ceph.restart:
+    daemons: [mon.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- ceph.restart:
+    daemons: [mgr.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- ceph.restart:
+    daemons: [osd.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+    wait-for-osds-up: true
+- ceph.restart:
+    daemons: [mds.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/radosbench.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/radosbench.yaml
new file mode 100644 (file)
index 0000000..55bd378
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/12-workload-after-rotate/radosbench.yaml
@@ -0,0 +1,6 @@
+tasks:
+  - radosbench:
+      extra_args: --log-to-stderr=false --log-to-file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
+      clients: [client.0]
+      time: 10
+      unique_pool: true

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/13-healthy.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/13-healthy.yaml
new file mode 100644 (file)
index 0000000..bc38604
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/X/tasks/13-healthy.yaml
@@ -0,0 +1,5 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/2-debug.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/2-debug.yaml
deleted file mode 100644 (file)
index f0352e6..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/2-debug.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-tasks:
-- full_sequential_finally:
-  - exec:
-      mon.a:
-        - sleep 1m
-- exec:
-    mon.a:
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config dump
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/radosbench.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/radosbench.yaml
deleted file mode 100644 (file)
index cc18fab..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/3-workload/radosbench.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-radosbench:
-  sequential_yield:
-    - radosbench:
-        extra_args: --log-to-stderr=false --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
-        clients: [client.0]
-        time: 300
-        unique_pool: true
-
-tasks:
-  - sequential_yield:
-      - radosbench

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/4-cephx-service-upgrade.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/4-cephx-service-upgrade.yaml
deleted file mode 100644 (file)
index c193a55..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/4-cephx-service-upgrade.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-tasks:
-- ceph.key_rotate:
-    daemons: [mon.*]
-    key_type: aes256k
-- ceph.key_rotate:
-    daemons: [mgr.*, osd.*, mds.*]
-    key_type: aes256k
-- exec:
-    mon.a:
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.key.type == 1 or .key.type == 2 or .key.type == 4 or .key.type == 16); .val.key.type != 2)'
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq '.data.rotating_secrets | all( .val.secrets | all(.val.key.type == 1) )'
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config set global auth_service_cipher aes256k

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/no.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/no.yaml
deleted file mode 100644 (file)
index 2290d55..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/no.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-teuthology:
-  variables:
-    wipe_service_keys: false

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/yes.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/yes.yaml
deleted file mode 100644 (file)
index b766074..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/5-wipe-service-keys/yes.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-tasks:
-- exec:
-    mon.a:
-      - ceph auth wipe-rotating-service-keys
-      - ceph auth --format=json-pretty dump-keys
-      - ceph auth --format=json dump-keys | jq '.data.rotating_secrets | all(  if .key == 32 then  (.val.secrets | all(.val.key.type == 1))  else  (.val.secrets | all(.val.key.type == 2))  end  )'

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/no.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/no.yaml
deleted file mode 100644 (file)
index e69de29..0000000

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/sleep.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/sleep.yaml
deleted file mode 100644 (file)
index 398439f..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/sleep.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-# Sleep for ticket refresh.
-tasks:
-- sleep:
-    duration: 500

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/yes.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/yes.yaml
deleted file mode 100644 (file)
index 56c7271..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/6-daemon-restart/yes.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-overrides:
-  ceph:
-    log-ignorelist:
-      - OSD_DOWN
-      - OSD_ROOT_DOWN
-tasks:
-- sleep:
-    duration: 10
-- ceph.restart:
-    daemons: [mon.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [mgr.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [osd.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-    wait-for-osds-up: true
-- ceph.restart:
-    daemons: [mds.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/.qa b/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/radosbench.yaml b/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/radosbench.yaml
deleted file mode 100644 (file)
index 55bd378..0000000
--- a/qa/suites/rados/upgrade/cephx/X/tasks/7-workload-after-rotate/radosbench.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-tasks:
-  - radosbench:
-      extra_args: --log-to-stderr=false --log-to-file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
-      clients: [client.0]
-      time: 10
-      unique_pool: true

diff --git a/qa/suites/rados/upgrade/cephx/release-X/conf.yaml b/qa/suites/rados/upgrade/cephx/release-X/conf.yaml
index cdae16430079b8507b16d4cb7a6ea25c88d0414d..895c6b1ee9105f6b0086ad5e3a9c126afd37fd67 100644 (file)
--- a/qa/suites/rados/upgrade/cephx/release-X/conf.yaml
+++ b/qa/suites/rados/upgrade/cephx/release-X/conf.yaml
@@ -10,4 +10,5 @@ overrides:
         auth service ticket ttl: 120
       mon:
         debug mon: 30
+        debug paxos: 30
         debug ms: 5

diff --git a/qa/suites/rados/upgrade/cephx/release-X/roles.yaml b/qa/suites/rados/upgrade/cephx/release-X/roles.yaml
index 5baa2657abc7332768591bc6b5ff27ba3d12051e..428a9b542537638e3ca495c5ec66fd57d23307cb 100644 (file)
--- a/qa/suites/rados/upgrade/cephx/release-X/roles.yaml
+++ b/qa/suites/rados/upgrade/cephx/release-X/roles.yaml
@@ -2,4 +2,5 @@ roles:
 - [mon.a, mds.a, mgr.x, osd.0, osd.1]
 - [mon.b, mon.c, mds.b, mgr.y, osd.2, osd.3]
 - [client.0]
-- [client.1]
+# need to handle pruning if we want a client with older binaries
+#- [client.1]

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v18.2.7.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v18.2.7.yaml
deleted file mode 100644 (file)
index dac4fb1..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v18.2.7.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-meta:
-- desc: |
-   install ceph/reef v18.2.7
-tasks:
-- install:
-    tag: v18.2.7
-    exclude_packages:
-      - librados3
-      - ceph-mgr-dashboard
-      - ceph-mgr-diskprediction-local
-      - ceph-mgr-rook
-      - ceph-mgr-cephadm
-      - cephadm
-      - ceph-volume
-    extra_packages: ['librados2']
-- print: "**** done installing v18.2.7"
-- ceph:
-    log-ignorelist:
-      - overall HEALTH_
-      - \(FS_
-      - \(MDS_
-      - \(OSD_
-      - \(MON_DOWN\)
-      - \(CACHE_POOL_
-      - \(POOL_
-      - \(MGR_DOWN\)
-      - \(PG_
-      - \(SMALLER_PGP_NUM\)
-      - Monitor daemon marked osd
-      - Behind on trimming
-      - Manager daemon
-    conf:
-      global:
-        mon warn on pool no app: false
-- exec:
-    osd.0:
-      - ceph osd set-require-min-compat-client reef
-- print: "**** done ceph"

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v19.2.2.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v19.2.2.yaml
deleted file mode 100644 (file)
index 651f8d3..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/0-from/v19.2.2.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-meta:
-- desc: |
-   install ceph/squid v19.2.2
-tasks:
-- install:
-    tag: v19.2.2
-    exclude_packages:
-      - librados3
-      - ceph-mgr-dashboard
-      - ceph-mgr-diskprediction-local
-      - ceph-mgr-rook
-      - ceph-mgr-cephadm
-      - cephadm
-      - ceph-volume
-    extra_packages: ['librados2']
-- print: "**** done installing squid v19.2.2"
-- ceph:
-    log-ignorelist:
-      - overall HEALTH_
-      - \(FS_
-      - \(MDS_
-      - \(OSD_
-      - \(MON_DOWN\)
-      - \(CACHE_POOL_
-      - \(POOL_
-      - \(MGR_DOWN\)
-      - \(PG_
-      - \(SMALLER_PGP_NUM\)
-      - Monitor daemon marked osd
-      - Behind on trimming
-      - Manager daemon
-    conf:
-      global:
-        mon warn on pool no app: false
-- exec:
-    osd.0:
-      - ceph osd set-require-min-compat-client squid
-- print: "**** done ceph"

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v18.2.7.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v18.2.7.yaml
new file mode 100644 (file)
index 0000000..40d798a
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v18.2.7.yaml
@@ -0,0 +1,33 @@
+meta:
+- desc: |
+   install ceph/reef v18.2.7
+tasks:
+- install:
+    tag: v18.2.7
+    exclude_packages:
+      - librados3
+      - ceph-mgr-dashboard
+      - ceph-mgr-diskprediction-local
+      - ceph-mgr-rook
+      - ceph-mgr-cephadm
+      - cephadm
+      - ceph-volume
+    extra_packages: ['librados2']
+- print: "**** done installing v18.2.7"
+- ceph:
+    log-ignorelist:
+      - AUTH_INSECURE_KEYS_ALLOWED
+      - AUTH_INSECURE_KEYS_CREATABLE
+      - AUTH_INSECURE_SERVICE_TICKETS
+      - AUTH_INSECURE_CLIENT_KEY_TYPE
+      - AUTH_INSECURE_SERVICE_KEY_TYPE
+      - AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+    conf:
+      mon:
+        mon_health_to_clog: false
+      global:
+        mon warn on pool no app: false
+- exec:
+    osd.0:
+      - ceph osd set-require-min-compat-client reef
+- print: "**** done ceph"

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v19.2.2.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v19.2.2.yaml
new file mode 100644 (file)
index 0000000..1757d1b
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/00-from/v19.2.2.yaml
@@ -0,0 +1,33 @@
+meta:
+- desc: |
+   install ceph/squid v19.2.2
+tasks:
+- install:
+    tag: v19.2.2
+    exclude_packages:
+      - librados3
+      - ceph-mgr-dashboard
+      - ceph-mgr-diskprediction-local
+      - ceph-mgr-rook
+      - ceph-mgr-cephadm
+      - cephadm
+      - ceph-volume
+    extra_packages: ['librados2']
+- print: "**** done installing squid v19.2.2"
+- ceph:
+    log-ignorelist:
+      - AUTH_INSECURE_KEYS_ALLOWED
+      - AUTH_INSECURE_KEYS_CREATABLE
+      - AUTH_INSECURE_SERVICE_TICKETS
+      - AUTH_INSECURE_CLIENT_KEY_TYPE
+      - AUTH_INSECURE_SERVICE_KEY_TYPE
+      - AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+    conf:
+      mon:
+        mon_health_to_clog: false
+      global:
+        mon warn on pool no app: false
+- exec:
+    osd.0:
+      - ceph osd set-require-min-compat-client squid
+- print: "**** done ceph"

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/01-debug.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/01-debug.yaml
new file mode 100644 (file)
index 0000000..17811fd
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/01-debug.yaml
@@ -0,0 +1,13 @@
+tasks:
+- full_sequential_finally:
+  - exec:
+      mon.a:
+        - sleep 1m
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/none.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/none.yaml
new file mode 100644 (file)
index 0000000..a4cbcfe
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/none.yaml
@@ -0,0 +1,3 @@
+teuthology:
+  variables:
+    workload: none

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/radosbench.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/radosbench.yaml
new file mode 100644 (file)
index 0000000..f75bc09
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/02-workload/radosbench.yaml
@@ -0,0 +1,15 @@
+teuthology:
+  variables:
+    workload: radosbench
+
+radosbench:
+  sequential_yield:
+    - radosbench:
+        extra_args: --log-to-stderr=false --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
+        clients: [client.0]
+        time: 900
+        unique_pool: true
+
+tasks:
+  - sequential_yield:
+      - radosbench

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/03-upgrade.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/03-upgrade.yaml
new file mode 100644 (file)
index 0000000..9d88687
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/03-upgrade.yaml
@@ -0,0 +1,44 @@
+tasks:
+- install.upgrade:
+    mon.a:
+    mon.b:
+    client.0:
+- ceph.restart:
+    daemons: [mgr.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- ceph.restart:
+    daemons: [mon.*]
+    mon-health-to-clog: false
+    wait-for-healthy: false
+- ceph.key_prune: ["client.bootstrap-*"]
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config set mon mon_auth_allow_insecure_key true
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_ALLOWED --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_CREATABLE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_SERVICE_TICKETS --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_CLIENT_KEY_TYPE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_SERVICE_KEY_TYPE --sticky
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE --sticky
+- ceph.healthy:
+- ceph.restart:
+    daemons: [osd.*]
+    mon-health-to-clog: false
+    wait-for-osds-up: true
+    wait-for-healthy: false
+- exec:
+    mon.a:
+      - ceph versions
+      - ceph osd dump -f json-pretty
+      - ceph osd require-osd-release tentacle
+      - for f in `ceph osd pool ls` ; do ceph osd pool set $f pg_autoscale_mode off ; done
+- ceph.healthy:
+- ceph.restart:
+    daemons: [mds.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- exec:
+    mon.a:
+      - ceph versions
+      - ceph fs dump

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/04-allow-aes256k.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/04-allow-aes256k.yaml
new file mode 100644 (file)
index 0000000..fe4f9a7
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/04-allow-aes256k.yaml
@@ -0,0 +1,10 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 1 or .entity.type == 2 or .entity.type == 4 or .entity.type == 16); .auth.key.type == 1)'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_allowed_ciphers aes,aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_preferred_cipher aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/05-service-auth-keys.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/05-service-auth-keys.yaml
new file mode 100644 (file)
index 0000000..94e5bb5
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/05-service-auth-keys.yaml
@@ -0,0 +1,20 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_SERVICE_KEY_TYPE]
+- ceph.key_rotate:
+    daemons: [mon.*]
+    key_type: aes256k
+- ceph.key_rotate:
+    daemons: [mgr.*, osd.*, mds.*]
+    key_type: aes256k
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 1 or .entity.type == 2 or .entity.type == 4 or .entity.type == 16); .auth.key.type == 2)'
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/06-insecure-create.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/06-insecure-create.yaml
new file mode 100644 (file)
index 0000000..48386c2
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/06-insecure-create.yaml
@@ -0,0 +1,25 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_CREATABLE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_KEYS_CREATABLE]
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config rm mon 'mon auth allow insecure key'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+# The default when auth_allow_ciphers inclues aes, retain default mon_auth_allow_insecure_key=true
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_KEYS_CREATABLE]
+# Now setting it overrides:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config set mon 'mon auth allow insecure key' false
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/admin.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/admin.yaml
new file mode 100644 (file)
index 0000000..2372afc
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/admin.yaml
@@ -0,0 +1,34 @@
+teuthology:
+  variables:
+    clients_all_rotated: false
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.workload == 'none' then
+        reject()
+      end
+
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_CLIENT_KEY_TYPE
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_CLIENT_KEY_TYPE]
+  - ceph.key_rotate:
+      daemons: []
+      clients: [client.admin]
+      key_type: aes256k
+  - exec:
+      mon.a:
+        - |
+          ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys | \
+          jq '
+            .data.secrets[] |
+            select(
+              .entity.type_str == "client" and .entity.id == "admin"
+            ) | .auth.key.type == 2
+          '
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_CLIENT_KEY_TYPE --sticky
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/all.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/all.yaml
new file mode 100644 (file)
index 0000000..91a450a
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/07-client-auth-keys/all.yaml
@@ -0,0 +1,28 @@
+# N.B. we can only rotate all keys if we do not have an existing workload.
+
+teuthology:
+  variables:
+    clients_all_rotated: true
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.workload ~= 'none' then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_CLIENT_KEY_TYPE
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_CLIENT_KEY_TYPE]
+  - ceph.key_rotate:
+      daemons: []
+      clients: [all]
+      key_type: aes256k
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.entity.type == 8); .auth.key.type == 2)'
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/aes256k.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/aes256k.yaml
new file mode 100644 (file)
index 0000000..fb24438
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/aes256k.yaml
@@ -0,0 +1,19 @@
+teuthology:
+  postmerge:
+    - | 
+      if not yaml.teuthology.variables.clients_all_rotated then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_ALLOWED
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_KEYS_ALLOWED]
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_allowed_ciphers aes256k
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/insecure.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/insecure.yaml
new file mode 100644 (file)
index 0000000..05bc48f
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/08-allowed-ciphers/insecure.yaml
@@ -0,0 +1,19 @@
+teuthology:
+  postmerge:
+    - | 
+      if yaml.teuthology.variables.clients_all_rotated then
+        reject()
+      end
+
+tasks:
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_KEYS_ALLOWED
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+  - ceph.healthy:
+      expected_checks: [AUTH_INSECURE_KEYS_ALLOWED]
+  - exec:
+      mon.a:
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump --format=json | jq '.auth_allowed_ciphers | (map(.name) | sort) == ["aes", "aes256k"]'
+        - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health mute AUTH_INSECURE_KEYS_ALLOWED --sticky
+  - ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/09-cephx-service-upgrade.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/09-cephx-service-upgrade.yaml
new file mode 100644 (file)
index 0000000..dafc6d7
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/09-cephx-service-upgrade.yaml
@@ -0,0 +1,10 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq '.data.rotating_secrets | all( .secrets.keys | all(.expiring_key.key.type == 1) )'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon set auth_service_cipher aes256k
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 mon dump
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/1-debug.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/1-debug.yaml
deleted file mode 100644 (file)
index 233edca..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/1-debug.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-tasks:
-- full_sequential_finally:
-  - exec:
-      mon.a:
-        - sleep 1m
-- exec:
-    mon.a:
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.a config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.b config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 tell mon.c config diff
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 config dump
-      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/no.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/no.yaml
new file mode 100644 (file)
index 0000000..2290d55
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/no.yaml
@@ -0,0 +1,3 @@
+teuthology:
+  variables:
+    wipe_service_keys: false

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/sleep.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/sleep.yaml
new file mode 100644 (file)
index 0000000..d6956ca
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/sleep.yaml
@@ -0,0 +1,11 @@
+# Sleep for ticket refresh.
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE]
+- sleep:
+    duration: 720
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/yes.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/yes.yaml
new file mode 100644 (file)
index 0000000..001a6d1
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/10-wipe-service-keys/yes.yaml
@@ -0,0 +1,14 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:
+    expected_checks: [AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE]
+- exec:
+    mon.a:
+      - ceph auth wipe-rotating-service-keys
+      - ceph auth --format=json-pretty dump-keys
+      - ceph auth --format=json dump-keys | jq '.data.rotating_secrets | all(  if .entity.type == 32 then  (.secrets.keys | all(.expiring_key.key.type == 1)) else (.secrets.keys | all(.expiring_key.key.type == 2))  end  )'
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health unmute AUTH_INSECURE_SERVICE_TICKETS
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/no.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/no.yaml
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/yes.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/yes.yaml
new file mode 100644 (file)
index 0000000..56c7271
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/11-daemon-restart/yes.yaml
@@ -0,0 +1,25 @@
+overrides:
+  ceph:
+    log-ignorelist:
+      - OSD_DOWN
+      - OSD_ROOT_DOWN
+tasks:
+- sleep:
+    duration: 10
+- ceph.restart:
+    daemons: [mon.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- ceph.restart:
+    daemons: [mgr.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+- ceph.restart:
+    daemons: [osd.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true
+    wait-for-osds-up: true
+- ceph.restart:
+    daemons: [mds.*]
+    mon-health-to-clog: false
+    wait-for-healthy: true

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/.qa
new file mode 120000 (symlink)
index 0000000..a602a03
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/.qa
@@ -0,0 +1 @@
+../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/radosbench.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/radosbench.yaml
new file mode 100644 (file)
index 0000000..55bd378
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/12-workload-after-rotate/radosbench.yaml
@@ -0,0 +1,6 @@
+tasks:
+  - radosbench:
+      extra_args: --log-to-stderr=false --log-to-file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
+      clients: [client.0]
+      time: 10
+      unique_pool: true

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/13-healthy.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/13-healthy.yaml
new file mode 100644 (file)
index 0000000..bc38604
--- /dev/null
+++ b/qa/suites/rados/upgrade/cephx/release-X/tasks/13-healthy.yaml
@@ -0,0 +1,5 @@
+tasks:
+- exec:
+    mon.a:
+      - ceph --log-to-stderr=true --log_to_file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 health detail
+- ceph.healthy:

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/radosbench.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/radosbench.yaml
deleted file mode 100644 (file)
index 4320ec6..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/2-workload/radosbench.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# We can't set auth_exit_on_failure here because squid/reef do not understand that switch.
-#teuthology:
-#  postmerge:
-#  - |
-#    if false and yaml.teuthology.variables.wipe_service_keys then
-#        yaml.radosbench.sequential_yield[0].radosbench.auth_exit_on_failure = 99
-#        yaml.radosbench.sequential_yield[0].radosbench.expected_rc = 99
-#    end
-
-# N.B. because `rados bench` has sessions open with the OSDs, we do not expect
-# it to fail any auth after upgrade / rotation / session key wipe. It will only
-# fail new connections with OSDs.
-radosbench:
-  sequential_yield:
-    - radosbench:
-        extra_args: --log-to-stderr=false --log-to-file=true --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
-        clients: [client.0]
-        time: 300
-        unique_pool: true
-
-tasks:
-  - sequential_yield:
-      - radosbench

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/3-upgrade.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/3-upgrade.yaml
deleted file mode 100644 (file)
index a327fd1..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/3-upgrade.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-tasks:
-- install.upgrade:
-    mon.a:
-    mon.b:
-    client.0:
-- ceph.restart:
-    daemons: [mgr.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [mon.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [osd.*]
-    mon-health-to-clog: false
-    wait-for-osds-up: true
-    wait-for-healthy: false
-- exec:
-    mon.a:
-      - ceph versions
-      - ceph osd dump -f json-pretty
-      - ceph osd require-osd-release tentacle
-      - for f in `ceph osd pool ls` ; do ceph osd pool set $f pg_autoscale_mode off ; done
-- ceph.restart:
-    daemons: [mds.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- exec:
-    mon.a:
-      - ceph versions
-      - ceph fs dump

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/4-cephx-service-upgrade.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/4-cephx-service-upgrade.yaml
deleted file mode 100644 (file)
index 44f1ab2..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/4-cephx-service-upgrade.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-tasks:
-- ceph.key_rotate:
-    daemons: [mon.*]
-    key_type: aes256k
-- ceph.key_rotate:
-    daemons: [mgr.*, osd.*, mds.*]
-    key_type: aes256k
-- exec:
-    mon.a:
-      - ceph --debug_ms=5 --debug_auth=30 --debug_monc=30 auth ls
-      - ceph --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json-pretty dump-keys
-      - ceph --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq 'any(.data.secrets[] | select(.key.type == 1 or .key.type == 2 or .key.type == 4 or .key.type == 16); .val.key.type != 2)'
-      - ceph --debug_ms=5 --debug_auth=30 --debug_monc=30 auth --format=json dump-keys | jq '.data.rotating_secrets | all( .val.secrets | all(.val.key.type == 1) )'
-      - ceph --debug_ms=5 --debug_auth=30 --debug_monc=30 config set global auth_service_cipher aes256k

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/no.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/no.yaml
deleted file mode 100644 (file)
index 2290d55..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/no.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-teuthology:
-  variables:
-    wipe_service_keys: false

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/yes.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/yes.yaml
deleted file mode 100644 (file)
index e4ee1a4..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/5-wipe-service-keys/yes.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-# N.B. in order to effect a service key wipe, the service daemons must be
-# restarted next. During this time, service daemons will be inaccessible to new
-# clients.
-teuthology:
-  variables:
-    wipe_service_keys: true
-tasks:
-- exec:
-    mon.a:
-      - ceph auth wipe-rotating-service-keys
-      - ceph auth --format=json-pretty dump-keys
-      - ceph auth --format=json dump-keys | jq '.data.rotating_secrets | all(  if .key == 32 then  (.val.secrets | all(.val.key.type == 1))  else  (.val.secrets | all(.val.key.type == 2))  end  )'

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/no.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/no.yaml
deleted file mode 100644 (file)
index e69de29..0000000

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/yes.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/yes.yaml
deleted file mode 100644 (file)
index 56c7271..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/6-daemon-restart/yes.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-overrides:
-  ceph:
-    log-ignorelist:
-      - OSD_DOWN
-      - OSD_ROOT_DOWN
-tasks:
-- sleep:
-    duration: 10
-- ceph.restart:
-    daemons: [mon.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [mgr.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-- ceph.restart:
-    daemons: [osd.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true
-    wait-for-osds-up: true
-- ceph.restart:
-    daemons: [mds.*]
-    mon-health-to-clog: false
-    wait-for-healthy: true

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/.qa b/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/.qa
deleted file mode 120000 (symlink)
index a602a03..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/.qa
+++ /dev/null
@@ -1 +0,0 @@
-../.qa/
\ No newline at end of file

diff --git a/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/radosbench.yaml b/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/radosbench.yaml
deleted file mode 100644 (file)
index 1678f63..0000000
--- a/qa/suites/rados/upgrade/cephx/release-X/tasks/7-workload-after-rotate/radosbench.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-tasks:
-  - radosbench:
-      extra_args: --debug_ms=5 --debug_auth=30 --debug_monc=30 --mon_client_target_rank=0
-      clients: [client.0]
-      time: 10
-      unique_pool: true