Ability to secure cluster pools

We set several flags to keep the cluster secure:
* nodelete
* nopgchange
* nosizechange

Signed-off-by: Sébastien Han <sebastien.han@enovance.com>

diff --git a/group_vars/mons b/group_vars/mons
index a2c00346875740b8d8cd8930160437e7e4b554e2..9f956de6a525323f0dd78f03231223bded2d5f9c 100644 (file)
--- a/group_vars/mons
+++ b/group_vars/mons
@@ -1,12 +1,67 @@
----
-# Variables here are applicable to all host groups NOT roles
-
-# Dummy variable to avoid error because ansible does not recognize the file as a good configuration file when no variable in it.
-dummy:
-
-# Monitor options
-#monitor_secret: # /!\ GENERATE ONE WITH 'ceph-authtool --gen-print-key' /!\
-#cephx: true
-
-# Rados Gateway options
-#radosgw: false
+---\r
+# You can override vars by using host or group vars\r
+# Variables here are applicable to all host groups NOT roles\r
+\r
+# Dummy variable to avoid error because ansible does not recognize the file as a good configuration file when no variable in it.\r
+dummy:\r
+\r
+###########\r
+# GENERAL #\r
+###########\r
+\r
+# ACTIVATE BOTH FSID AND MONITOR_SECRET VARIABLES FOR NON-VAGRANT DEPLOYMENT\r
+#fsid: "{{ cluster_uuid.stdout }}"\r
+# monitor_secret:\r
+#cephx: true\r
+\r
+# Rados Gateway options\r
+# referenced in common role too.\r
+#radosgw: false\r
+\r
+# CephFS\r
+#pool_default_pg_num: 128\r
+#cephfs_data: cephfs_data\r
+#cephfs_metadata: cephfs_metadata\r
+#cephfs: cephfs\r
+\r
+# Ceph REST API\r
+# referenced in common role too.\r
+#restapi: false\r
+\r
+# Secure your cluster\r
+# This will set the following flags on all the pools:\r
+# * nosizechange\r
+# * nopgchange\r
+# * nodelete\r
+\r
+#secure_cluster: false\r
+#secure_cluster_flags:\r
+#  - nopgchange\r
+#  - nodelete\r
+#  - nosizechange\r
+#\r
+\r
+#############\r
+# OPENSTACK #\r
+#############\r
+\r
+#openstack_config: false\r
+#openstack_glance_pool: images\r
+#openstack_cinder_pool: volumes\r
+#openstack_nova_pool: vms\r
+#openstack_cinder_backup_pool: backups\r
+#\r
+#openstack_keys:\r
+#  - { name: client.glance, value: "mon 'allow r' osd 'allow class-read object_prefix rbd_children, allow rwx pool={{ openstack_glance_pool }}'" }\r
+#  - { name: client.cinder, value: "mon 'allow r' osd 'allow class-read object_prefix rbd_children, allow rwx pool={{ openstack_cinder_pool }}, allow rwx pool={{ openstack_nova_pool }}, allow rx pool={{ openstack_glance_pool }}'"  }\r
+#  - { name: client.cinder-backup, value: "mon 'allow r' osd 'allow class-read object_prefix rbd_children, allow rwx pool={{ openstack_cinder_backup_pool }}'" }\r
+\r
+\r
+##########\r
+# DOCKER #\r
+##########\r
+\r
+#ceph_containerized_deployment: false\r
+#ceph_mon_docker_interface: eth0\r
+#ceph_mon_docker_username: ceph\r
+#ceph_mon_docker_imagename: "mon:latest"\r

diff --git a/roles/ceph-mon/defaults/main.yml b/roles/ceph-mon/defaults/main.yml
index d4fc7e83da036d6af437ff11d6ea0e9092b2ae87..ad48166fe444249cabc0d8e65d906211b179d182 100644 (file)
--- a/roles/ceph-mon/defaults/main.yml
+++ b/roles/ceph-mon/defaults/main.yml
@@ -24,6 +24,18 @@ cephfs: cephfs
 # referenced in common role too.\r
 restapi: false\r
 \r
+# Secure your cluster\r
+# This will set the following flags on all the pools:\r
+# * nosizechange\r
+# * nopgchange\r
+# * nodelete\r
+\r
+secure_cluster: false\r
+secure_cluster_flags:\r
+  - nopgchange\r
+  - nodelete\r
+  - nosizechange\r
+\r
 \r
 #############\r
 # OPENSTACK #\r

diff --git a/roles/ceph-mon/tasks/main.yml b/roles/ceph-mon/tasks/main.yml
index 0f544efd181468bdc13acda7eda900e4397412b7..576f3fb5114092c3d52a0b56a0c4aad077374294 100644 (file)
--- a/roles/ceph-mon/tasks/main.yml
+++ b/roles/ceph-mon/tasks/main.yml
@@ -11,5 +11,9 @@
 - include: create_mds_filesystems.yml
   when: not ceph_containerized_deployment and not {{ ceph_version.stdout | version_compare('0.84', '<') }} and mds
 
+- include: secure_cluster.yml
+  when: secure_cluster and {{ ceph_version.stdout | version_compare('0.94', '>=') }}
+  tags: secure_cluster
+
 - include: docker.yml
   when: ceph_containerized_deployment

diff --git a/roles/ceph-mon/tasks/secure_cluster.yml b/roles/ceph-mon/tasks/secure_cluster.yml
new file mode 100644 (file)
index 0000000..4ce5ec2
--- /dev/null
+++ b/roles/ceph-mon/tasks/secure_cluster.yml
@@ -0,0 +1,10 @@
+---
+- name: collect all the pool
+  command: rados lspools
+  register: ceph_pools
+
+- name: secure the cluster
+  command: ceph osd pool set {{ item[0] }} {{ item[1] }} true
+  with_nested:
+    - ceph_pools.stdout_lines
+    - secure_cluster_flags