Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1540845 - [Ceph-ansible] Failure on TASK [ceph-iscsi-gw : lock ssl file access to root only]
Summary: [Ceph-ansible] Failure on TASK [ceph-iscsi-gw : lock ssl file access to root ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: Ceph-Ansible
Version: 3.0
Hardware: Unspecified
OS: Unspecified
medium
urgent
Target Milestone: z2
: 3.0
Assignee: leseb
QA Contact: mkasturi
Erin Donnelly
URL:
Whiteboard:
Depends On:
Blocks: 1557269 1544643 1600697
TreeView+ depends on / blocked
 
Reported: 2018-02-01 06:41 UTC by Pratik Surve
Modified: 2018-07-12 19:43 UTC (History)
16 users (show)

Fixed In Version: RHEL: ceph-ansible-3.0.29-1.el7cp Ubuntu: ceph-ansible_3.0.29-2redhat1
Doc Type: Bug Fix
Doc Text:
Previously, deployment of only one Ceph iSCSI Gateway node was supported because SSL certificated were only generated for one Ceph iSCSI Gateway node when using the "ceph-ansible" utility. This issue has been fixed, the certificates are distributed across all the gateways and more than one iSCSI Gateway node can now be deployed.
Clone Of:
Environment:
Last Closed: 2018-04-26 17:38:39 UTC
Target Upstream Version:


Attachments (Terms of Use)
The zip contains logs of ansible, iscsi-gws.yml,all.yml (deleted)
2018-02-01 06:41 UTC, Pratik Surve
no flags Details


Links
System ID Priority Status Summary Last Updated
Github ceph ceph-ansible pull 2489 None None None 2018-04-03 21:25:11 UTC
Red Hat Product Errata RHBA-2018:1259 None None None 2018-04-26 17:40:22 UTC

Description Pratik Surve 2018-02-01 06:41:22 UTC
Created attachment 1389346 [details]
The zip contains logs of ansible, iscsi-gws.yml,all.yml

Description of problem:
i was setting-up iscsi-gateways using ceph ansible with 2 node collocated with osd ceph-ansible failed saying 

TASK [ceph-iscsi-gw : lock ssl file access to root only] **********************************************************************************************************************************************************
 [WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ceph_release_num.{{ ceph_release }} >= ceph_release_num.luminous

 [WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ceph_release_num.{{ ceph_release }} >= ceph_release_num.luminous

changed: [magna075] => (item=/etc/ceph/iscsi-gateway.crt)
failed: [magna078] (item=/etc/ceph/iscsi-gateway.crt) => {"changed": false, "item": "/etc/ceph/iscsi-gateway.crt", "msg": "file (/etc/ceph/iscsi-gateway.crt) is absent, cannot continue", "path": "/etc/ceph/iscsi-gateway.crt", "state": "absent"}
changed: [magna075] => (item=/etc/ceph/iscsi-gateway.key)
failed: [magna078] (item=/etc/ceph/iscsi-gateway.key) => {"changed": false, "item": "/etc/ceph/iscsi-gateway.key", "msg": "file (/etc/ceph/iscsi-gateway.key) is absent, cannot continue", "path": "/etc/ceph/iscsi-gateway.key", "state": "absent"}
changed: [magna075] => (item=/etc/ceph/iscsi-gateway.pem)
failed: [magna078] (item=/etc/ceph/iscsi-gateway.pem) => {"changed": false, "item": "/etc/ceph/iscsi-gateway.pem", "msg": "file (/etc/ceph/iscsi-gateway.pem) is absent, cannot continue", "path": "/etc/ceph/iscsi-gateway.pem", "state": "absent"}
changed: [magna075] => (item=/etc/ceph/iscsi-gateway-pub.key)
failed: [magna078] (item=/etc/ceph/iscsi-gateway-pub.key) => {"changed": false, "item": "/etc/ceph/iscsi-gateway-pub.key", "msg": "file (/etc/ceph/iscsi-gateway-pub.key) is absent, cannot continue", "path": "/etc/ceph/iscsi-gateway-pub.key", "state": "absent"}

TASK [ceph-iscsi-gw : igw_lun | configure luns (create/map rbds and add to lio)] **********************************************************************************************************************************
 [WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ceph_release_num.{{ ceph_release }} >= ceph_release_num.luminous

changed: [magna075] => (item={u'host': u'magna075', u'image': u'ansible1', u'state': u'present', u'pool': u'rbd', u'size': u'30G'})
failed: [magna075] (item={u'host': u'magna078', u'image': u'ansible2', u'state': u'present', u'pool': u'rbd', u'size': u'15G'}) => {"changed": false, "item": {"host": "magna078", "image": "ansible2", "pool": "rbd", "size": "15G", "state": "present"}, "msg": "host name given for ansible2 is not a valid gateway name, listed in the config"}


Version-Release number of selected component (if applicable):
ceph-ansible-3.0.14-1.el7cp.noarch
ceph-iscsi-config-2.3-12.el7cp.noarch	


How reproducible:
always

Steps to Reproduce:
1.configure iscsi-gws.yml as per documentation
2.run the playbook

Actual results:


Expected results:


Additional info:
Attaching the playbook log.

Comment 4 Andrew Schoen 2018-02-12 16:34:18 UTC
The problem here is that even if you have multiple iscsi-gw nodes the playbook is only creating keys on one of the nodes. This happens because of ``run_once: True`` here: https://github.com/ceph/ceph-ansible/blob/stable-3.0/roles/ceph-iscsi-gw/tasks/generate_crt.yml#L5

However, when you get to the 'lock ssl file access to root only' task it tries to run on both iscsi-gw nodes and one fails because keys where not generated on it. Notice the lack of ``run_once: True`` here: https://github.com/ceph/ceph-ansible/blob/stable-3.0/roles/ceph-iscsi-gw/tasks/generate_crt.yml#L20

Comment 13 leseb 2018-03-13 16:46:14 UTC
Can we just then add a doc text and move ahead with this?
Thanks

Comment 19 leseb 2018-03-28 15:57:16 UTC
Tejas, this is surprising, there hasn't been any chances since 3.0.25-1.el7cp.noarch, see:

git show --name-only --pretty="" v3.0.25..v3.0.28
roles/ceph-common/tasks/misc/system_tuning.yml
roles/ceph-rgw/handlers/main.yml
tests/functional/centos/7/docker/group_vars/rgws
roles/ceph-rgw/tasks/docker/copy_configs.yml
roles/ceph-rgw/handlers/main.yml
tox.ini
roles/ceph-client/tasks/pre_requisite.yml
roles/ceph-mds/tasks/non_containerized.yml
roles/ceph-mon/tasks/openstack_config.yml
tests/functional/centos/7/cluster/ceph-override.json
tests/functional/centos/7/ooo-collocation/Vagrantfile
tests/functional/centos/7/ooo-collocation/ceph-override.json
tests/functional/centos/7/ooo-collocation/hosts
tests/functional/centos/7/ooo-collocation/vagrant_variables.yml
tox.ini
roles/ceph-defaults/handlers/main.yml
roles/ceph-common/tasks/misc/system_tuning.yml
infrastructure-playbooks/rolling_update.yml

The role ceph-iscsi hasn't been touched, so I'm wondering why the workaround doesn't work.

Are we talking about the original issue or something new just came up?
Thanks.

Comment 21 leseb 2018-03-29 11:47:08 UTC
Unfortunately, it is not reproducible anywhere, can we access an env where the issue is reproducible 100%? Thanks.

Comment 24 leseb 2018-04-03 13:20:57 UTC
Testing a patch upstream.

Comment 29 leseb 2018-04-12 16:36:38 UTC
Erin, edited the text, feel free to re-phrase :)

Comment 33 errata-xmlrpc 2018-04-26 17:38:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1259


Note You need to log in before you can comment on or make changes to this bug.