From: Sam Choraria Date: Tue, 3 Dec 2019 12:23:13 +0000 (+0000) Subject: ceph-rgw: allow SSL certificate content to supplied X-Git-Tag: v6.0.0alpha1~54 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=2a2656a985f8ef29a8b01f4fde746679ee76b856;p=ceph-ansible.git ceph-rgw: allow SSL certificate content to supplied Allow SSL certificate & key contents to be written to the path specified by radosgw_frontend_ssl_certificate. This permits a certificate to be deployed & renewal of expired certificates through ceph-ansible. Signed-off-by: Sam Choraria --- diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample index a5f759edf..a73db7a3a 100644 --- a/group_vars/all.yml.sample +++ b/group_vars/all.yml.sample @@ -405,6 +405,7 @@ dummy: #radosgw_frontend_port: "{{ radosgw_civetweb_port if radosgw_frontend_type == 'civetweb' else '8080' }}" # The server private key, public certificate and any other CA or intermediate certificates should be in one file, in PEM format. #radosgw_frontend_ssl_certificate: "" +#radosgw_frontend_ssl_certificate_data: "" # certificate contents to be written to path defined by radosgw_frontend_ssl_certificate #radosgw_frontend_options: "{{ radosgw_civetweb_options if radosgw_frontend_type == 'civetweb' else '' }}" #radosgw_thread_pool_size: 512 diff --git a/group_vars/rhcs.yml.sample b/group_vars/rhcs.yml.sample index ac341ec33..a2756709c 100644 --- a/group_vars/rhcs.yml.sample +++ b/group_vars/rhcs.yml.sample @@ -405,6 +405,7 @@ ceph_iscsi_config_dev: false #radosgw_frontend_port: "{{ radosgw_civetweb_port if radosgw_frontend_type == 'civetweb' else '8080' }}" # The server private key, public certificate and any other CA or intermediate certificates should be in one file, in PEM format. #radosgw_frontend_ssl_certificate: "" +#radosgw_frontend_ssl_certificate_data: "" # certificate contents to be written to path defined by radosgw_frontend_ssl_certificate #radosgw_frontend_options: "{{ radosgw_civetweb_options if radosgw_frontend_type == 'civetweb' else '' }}" #radosgw_thread_pool_size: 512 diff --git a/roles/ceph-defaults/defaults/main.yml b/roles/ceph-defaults/defaults/main.yml index bf70f5c17..2418810a5 100644 --- a/roles/ceph-defaults/defaults/main.yml +++ b/roles/ceph-defaults/defaults/main.yml @@ -397,6 +397,7 @@ radosgw_civetweb_options: "num_threads={{ radosgw_civetweb_num_threads }}" radosgw_frontend_port: "{{ radosgw_civetweb_port if radosgw_frontend_type == 'civetweb' else '8080' }}" # The server private key, public certificate and any other CA or intermediate certificates should be in one file, in PEM format. radosgw_frontend_ssl_certificate: "" +radosgw_frontend_ssl_certificate_data: "" # certificate contents to be written to path defined by radosgw_frontend_ssl_certificate radosgw_frontend_options: "{{ radosgw_civetweb_options if radosgw_frontend_type == 'civetweb' else '' }}" radosgw_thread_pool_size: 512 diff --git a/roles/ceph-rgw/tasks/common.yml b/roles/ceph-rgw/tasks/common.yml index dbf80a005..87fb3d66e 100644 --- a/roles/ceph-rgw/tasks/common.yml +++ b/roles/ceph-rgw/tasks/common.yml @@ -41,3 +41,13 @@ when: - cephx | bool - item.item.copy_key | bool + +- name: copy SSL certificate & key data to certificate path + copy: + content: "{{ radosgw_frontend_ssl_certificate_data }}" + dest: "{{ radosgw_frontend_ssl_certificate }}" + owner: "{{ ceph_uid if containerized_deployment else 'ceph' }}" + group: "{{ ceph_uid if containerized_deployment else 'ceph' }}" + mode: 0440 + when: radosgw_frontend_ssl_certificate | length > 0 and radosgw_frontend_ssl_certificate_data | length > 0 + notify: restart ceph rgws