stackforge-attic/cookbook-ceph
Code Issues Proposed changes

Merge pull request #40 from shellycloud/master

Browse Source 
Used encrypted data bags for storing secrets #34.
This commit is contained in:
Alexandre Marangone 2013-08-23 07:06:31 -07:00
commit c48998a6b9
6 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
attributes/default.rb
View File

@ -1 +1,2 @@
default['ceph']['install_debug'] = true
default['ceph']['encrypted_data_bags'] = false

1
attributes/mon.rb
View File

@ -4,3 +4,4 @@ when 'ubuntu'
else
default["ceph"]["mon"]["init_style"] = "sysvinit"
end
default["ceph"]["mon"]["secret_file"] = "/etc/chef/secrets/ceph_mon"

1
attributes/osd.rb
View File

@ -4,3 +4,4 @@ when 'ubuntu'
else
default["ceph"]["osd"]["init_style"] = "sysvinit"
end
default["ceph"]["osd"]["secret_file"] = "/etc/chef/secrets/ceph_osd"

2
recipes/apt.rb
View File

@ -5,7 +5,7 @@ branch = node['ceph']['branch']
apt_repository "ceph-#{branch}" do
repo_name "ceph"
uri node['ceph']['debian'][branch]['repository']
distribution node['lsb']['codename']
distribution node['lsb']['codename'] == "jessie" ? "sid" : node['lsb']['codename']
components ['main']
key node['ceph']['debian'][branch]['repository_key']
end

13
recipes/mon.rb
View File

@ -41,8 +41,15 @@ cluster = 'ceph'
unless File.exists?("/var/lib/ceph/mon/ceph-#{node["hostname"]}/done")
keyring = "#{Chef::Config[:file_cache_path]}/#{cluster}-#{node['hostname']}.mon.keyring"
monitor_secret = if node['ceph']['encrypted_data_bags']
secret = Chef::EncryptedDataBagItem.load_secret(node["ceph"]["mon"]["secret_file"])
Chef::EncryptedDataBagItem.load("ceph", "mon", secret)["secret"]
else
node["ceph"]["monitor-secret"]
end
execute "format as keyring" do
command "ceph-authtool '#{keyring}' --create-keyring --name=mon. --add-key='#{node["ceph"]["monitor-secret"]}' --cap mon 'allow *'"
command "ceph-authtool '#{keyring}' --create-keyring --name=mon. --add-key='#{monitor_secret}' --cap mon 'allow *'"
creates "#{Chef::Config[:file_cache_path]}/#{cluster}-#{node['hostname']}.mon.keyring"
end
@ -93,7 +100,8 @@ end
# The key is going to be automatically
# created,
# We store it when it is created
ruby_block "get osd-bootstrap keyring" do
unless node['ceph']['encrypted_data_bags']
ruby_block "get osd-bootstrap keyring" do
block do
run_out = ""
while run_out.empty?
@ -104,4 +112,5 @@ ruby_block "get osd-bootstrap keyring" do
node.save
end
not_if { node['ceph']['bootstrap_osd_key'] }
end
end

11
recipes/osd.rb
View File

@ -45,7 +45,7 @@ if !search(:node,"hostname:#{node['hostname']} AND dmcrypt:true").empty?
end
service_type = node["ceph"]["osd"]["init_style"]
mons = get_mon_nodes("ceph_bootstrap_osd_key:*")
mons = node['ceph']['encrypted_data_bags'] ? get_mon_nodes : get_mon_nodes("ceph_bootstrap_osd_key:*")
if mons.empty? then
puts "No ceph-mon found."
@ -60,8 +60,15 @@ else
# TODO cluster name
cluster = 'ceph'
osd_secret = if node['ceph']['encrypted_data_bags']
secret = Chef::EncryptedDataBagItem.load_secret(node["ceph"]["osd"]["secret_file"])
Chef::EncryptedDataBagItem.load("ceph", "osd", secret)["secret"]
else
mons[0]["ceph"]["bootstrap_osd_key"]
end
execute "format as keyring" do
command "ceph-authtool '/var/lib/ceph/bootstrap-osd/#{cluster}.keyring' --create-keyring --name=client.bootstrap-osd --add-key='#{mons[0]["ceph"]["bootstrap_osd_key"]}'"
command "ceph-authtool '/var/lib/ceph/bootstrap-osd/#{cluster}.keyring' --create-keyring --name=client.bootstrap-osd --add-key='#{osd_secret}'"
creates "/var/lib/ceph/bootstrap-osd/#{cluster}.keyring"
end