Skip to content

Commit 57437af

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1089 from rebtoor/ceph-migrate-prometheus
ceph_migrate: Enable firewall by default and enhance Prometheus/EDPM integration
2 parents 2a869be + b493fc5 commit 57437af

File tree

5 files changed

+67
-38
lines changed

5 files changed

+67
-38
lines changed

‎tests/roles/ceph_migrate/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ ceph_prometheus_container_image: "quay.io/prometheus/prometheus:v2.43.0"
6666
ceph_spec_render_dir: "/home/tripleo-admin"
6767
endif::[]
6868

69+
# Prometheus module configuration
70+
ceph_prometheus_server_port: 9283
71+
ceph_prometheus_server_addr: "0.0.0.0"
72+
6973
ceph_rgw_virtual_ips_list:
7074
- 172.17.3.99/24
7175
# - 10.0.0.99/24 # this requires the external network on the cephstorage node

‎tests/roles/ceph_migrate/defaults/main.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ ceph_wait_mon_timeout: 10
3232
ceph_keep_mon_ipaddr: true
3333

3434
# firewall section
35-
ceph_firewall_enabled: false
35+
ceph_firewall_enabled: true
3636
ceph_iptables_path:
3737
- "/etc/sysconfig/iptables"
3838
- "/etc/sysconfig/ip6tables"
39-
ceph_nftables_path: "/etc/nftables/tripleo-rules.nft"
39+
ceph_nftables_path: "/etc/nftables/edpm-rules.nft"
4040
ceph_firewall_type: nftables
4141

4242
# DEFAULT Ceph Reef container images
@@ -46,6 +46,10 @@ ceph_alertmanager_container_image: "quay.io/prometheus/alertmanager:v0.25.0"
4646
ceph_grafana_container_image: "quay.io/ceph/ceph-grafana:9.4.7"
4747
ceph_node_exporter_container_image: "quay.io/prometheus/node-exporter:v1.5.0"
4848
ceph_prometheus_container_image: "quay.io/prometheus/prometheus:v2.43.0"
49+
50+
# Prometheus module configuration
51+
ceph_prometheus_server_port: 9283
52+
ceph_prometheus_server_addr: "0.0.0.0"
4953
ceph_storagenfs_nic: "nic2"
5054
ceph_storagenfs_vlan_id: "70"
5155
rhoso_namespace: "openstack"

‎tests/roles/ceph_migrate/handlers/main.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@
33
become: true
44
ansible.builtin.command:
55
"{{ ceph_cli }} mgr fail"
6+
delegate_to: "{{ groups['ComputeHCI'][0] | default(inventory_hostname) }}"
7+
when:
8+
- groups['ComputeHCI'] is defined
9+
- groups['ComputeHCI'] | length > 0
10+
- ceph_cli is defined

‎tests/roles/ceph_migrate/tasks/firewall.yaml‎

Lines changed: 35 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,9 @@
11
# Add firewall rules for all the Ceph Services
22

3-
- name: Ensure firewall is temporarily stopped
4-
delegate_to: "{{ node }}"
5-
become: true
6-
ansible.builtin.systemd:
7-
name: "{{ item }}"
8-
state: stopped
9-
loop:
10-
- iptables
11-
- nftables
12-
133
- name: Manage Ceph iptables rules
14-
when: ceph_firewall_type == "iptables"
4+
when:
5+
- ceph_firewall_enabled | bool | default(true)
6+
- ceph_firewall_type == "iptables"
157
block:
168
- name: Ceph Migration - Apply the Ceph cluster rules (iptables)
179
delegate_to: "{{ node }}"
@@ -29,10 +21,13 @@
2921
-A INPUT -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -m comment --comment "111 ceph_nfs ipv4" -j ACCEPT
3022
-A INPUT -p tcp -m tcp --dport 12049 -m conntrack --ctstate NEW -m comment --comment "111 ceph_nfs_backend ipv4" -j ACCEPT
3123
-A INPUT -p tcp -m tcp --dport 6800:7300 -m conntrack --ctstate NEW -m comment --comment "112 ceph_mds_mgr ipv4" -j ACCEPT
24+
-A INPUT -p tcp -m tcp --dport 9283 -m conntrack --ctstate NEW -m comment --comment "113 ceph_prometheus ipv4" -j ACCEPT
3225
loop: "{{ ceph_iptables_path }}"
3326

3427
- name: Ensure firewall is enabled/started - iptables
35-
when: ceph_firewall_enabled | bool | default(false)
28+
when:
29+
- ceph_firewall_enabled | bool | default(true)
30+
- ceph_firewall_type == "iptables"
3631
delegate_to: "{{ node }}"
3732
become: true
3833
ansible.builtin.systemd:
@@ -41,7 +36,9 @@
4136
enabled: true
4237

4338
- name: Manage Ceph nftables rules
44-
when: ceph_firewall_type == "nftables"
39+
when:
40+
- ceph_firewall_enabled | bool | default(true)
41+
- ceph_firewall_type == "nftables"
4542
block:
4643
- name: Ceph Migration - Apply the Ceph cluster rules (nftables)
4744
delegate_to: "{{ node }}"
@@ -50,32 +47,34 @@
5047
marker_begin: "BEGIN ceph firewall rules"
5148
marker_end: "END ceph firewall rules"
5249
path: "{{ ceph_nftables_path }}"
50+
mode: "0644"
5351
block: |
54-
# 100 ceph_alertmanager {'dport': [9093]}
55-
add rule inet filter TRIPLEO_INPUT tcp dport { 9093 } ct state new counter accept comment "100 ceph_alertmanager"
56-
# 100 ceph_dashboard {'dport': [8443]}
57-
add rule inet filter TRIPLEO_INPUT tcp dport { 8443 } ct state new counter accept comment "100 ceph_dashboard"
58-
# 100 ceph_grafana {'dport': [3100]}
59-
add rule inet filter TRIPLEO_INPUT tcp dport { 3100 } ct state new counter accept comment "100 ceph_grafana"
60-
# 100 ceph_prometheus {'dport': [9092]}
61-
add rule inet filter TRIPLEO_INPUT tcp dport { 9092 } ct state new counter accept comment "100 ceph_prometheus"
62-
# 100 ceph_rgw {'dport': ['8080']}
63-
add rule inet filter TRIPLEO_INPUT tcp dport { 8080 } ct state new counter accept comment "100 ceph_rgw"
64-
# 110 ceph_mon {'dport': [6789, 3300, '9100']}
65-
add rule inet filter TRIPLEO_INPUT tcp dport { 6789,3300,9100 } ct state new counter accept comment "110 ceph_mon"
66-
# 112 ceph_mds {'dport': ['6800-7300', '9100']}
67-
add rule inet filter TRIPLEO_INPUT tcp dport { 6800-7300,9100 } ct state new counter accept comment "112 ceph_mds"
68-
# 113 ceph_mgr {'dport': ['6800-7300', 8444]}
69-
add rule inet filter TRIPLEO_INPUT tcp dport { 6800-7300,8444 } ct state new counter accept comment "113 ceph_mgr"
70-
# 120 ceph_nfs {'dport': ['12049', '2049']}
71-
add rule inet filter TRIPLEO_INPUT tcp dport { 2049 } ct state new counter accept comment "120 ceph_nfs"
72-
# 122 ceph rgw {'dport': ['8080', '8080', '9100']}
73-
add rule inet filter TRIPLEO_INPUT tcp dport { 8080,8080,9100 } ct state new counter accept comment "122 ceph rgw"
74-
# 123 ceph_dashboard {'dport': [3100, 9090, 9092, 9093, 9094, 9100, 9283]}
75-
add rule inet filter TRIPLEO_INPUT tcp dport { 3100,9090,9092,9093,9094,9100,9283 } ct state new counter accept comment "123 ceph_dashboard"
52+
# 100 ceph_alertmanager (9093)
53+
add rule inet filter EDPM_INPUT tcp dport { 9093 } ct state new counter accept comment "100 ceph_alertmanager"
54+
# 100 ceph_dashboard (8443)
55+
add rule inet filter EDPM_INPUT tcp dport { 8443 } ct state new counter accept comment "100 ceph_dashboard"
56+
# 100 ceph_grafana (3100)
57+
add rule inet filter EDPM_INPUT tcp dport { 3100 } ct state new counter accept comment "100 ceph_grafana"
58+
# 100 ceph_prometheus (9092)
59+
add rule inet filter EDPM_INPUT tcp dport { 9092 } ct state new counter accept comment "100 ceph_prometheus"
60+
# 100 ceph_rgw (8080)
61+
add rule inet filter EDPM_INPUT tcp dport { 8080 } ct state new counter accept comment "100 ceph_rgw"
62+
# 110 ceph_mon (6789, 3300, 9100)
63+
add rule inet filter EDPM_INPUT tcp dport { 6789,3300,9100 } ct state new counter accept comment "110 ceph_mon"
64+
# 112 ceph_mds (6800-7300, 9100)
65+
add rule inet filter EDPM_INPUT tcp dport { 6800-7300,9100 } ct state new counter accept comment "112 ceph_mds"
66+
# 113 ceph_mgr (6800-7300, 8444)
67+
add rule inet filter EDPM_INPUT tcp dport { 6800-7300,8444 } ct state new counter accept comment "113 ceph_mgr"
68+
# 120 ceph_nfs (2049, 12049)
69+
add rule inet filter EDPM_INPUT tcp dport { 2049,12049 } ct state new counter accept comment "120 ceph_nfs"
70+
# 123 ceph_dashboard (9090, 9094, 9283)
71+
add rule inet filter EDPM_INPUT tcp dport { 9090,9094,9283 } ct state new counter accept comment "123 ceph_dashboard"
72+
insertbefore: '^# Lock down INPUT chains'
7673

7774
- name: Ensure firewall is enabled/started - nftables
78-
when: ceph_firewall_enabled | bool | default(false)
75+
when:
76+
- ceph_firewall_enabled | bool | default(true)
77+
- ceph_firewall_type == "nftables"
7978
delegate_to: "{{ node }}"
8079
become: true
8180
ansible.builtin.systemd:

‎tests/roles/ceph_migrate/tasks/monitoring.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,23 @@
2424
ansible.builtin.command: |
2525
{{ ceph_cli }} mgr module enable dashboard
2626
27+
- name: Set ceph-mgr prometheus port configuration
28+
# cephadm runs w/ root privileges
29+
become: true
30+
block:
31+
- name: Set the prometheus server port
32+
ansible.builtin.command: |
33+
{{ ceph_cli }} config set mgr mgr/prometheus/server_port {{ ceph_prometheus_server_port }}
34+
changed_when: false
35+
- name: Set the prometheus server address
36+
ansible.builtin.command: |
37+
{{ ceph_cli }} config set mgr mgr/prometheus/server_addr {{ ceph_prometheus_server_addr }}
38+
changed_when: false
39+
- name: Enable prometheus module
40+
ansible.builtin.command: |
41+
{{ ceph_cli }} mgr module enable prometheus
42+
changed_when: false
43+
2744
# - Expand labels to the whole hostmap
2845
- name: Apply Monitoring label to the overcloud nodes
2946
ansible.builtin.import_tasks: labels.yaml

0 commit comments

Comments
 (0)