diff options
| author | Michał Nasiadka <mnasiadka@gmail.com> | 2021-04-23 16:17:33 +0200 |
|---|---|---|
| committer | Mark Goddard <mark@stackhpc.com> | 2021-04-27 12:45:57 +0000 |
| commit | a967b9dd66fad5b055b071794a4b059feed9fe90 (patch) | |
| tree | 2d5c22d6ec10dcd6183623ebf11b31a1eb9a8c4c /roles/cephadm | |
| parent | 058dd6828d788b60b6803f24f53f1dfca0876e6b (diff) | |
| download | kolla-ansible-a967b9dd66fad5b055b071794a4b059feed9fe90.tar.gz kolla-ansible-a967b9dd66fad5b055b071794a4b059feed9fe90.zip | |
cephadm: Set auth_allow_insecure_global_id_reclaim to true
Background in [1].
Ubuntu uses pre 15.2.11 client and new 15.2.11 installs default that to false,
therefore not allowing Ubuntu clients to connect.
[1]: https://docs.ceph.com/en/latest/security/CVE-2021-20288/
Change-Id: Ic251b447026262eab4b406b8432cc009ca97ae82
Diffstat (limited to 'roles/cephadm')
| -rw-r--r-- | roles/cephadm/tasks/main.yml | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/roles/cephadm/tasks/main.yml b/roles/cephadm/tasks/main.yml index d8795050e..06675186a 100644 --- a/roles/cephadm/tasks/main.yml +++ b/roles/cephadm/tasks/main.yml @@ -79,6 +79,17 @@ become: True loop: "{{ cephadm_ceph_osd_devices }}" +# NOTE(mnasiadka): Ubuntu uses pre 15.2.11 Octopus client code and suffers from +# https://docs.ceph.com/en/latest/security/CVE-2021-20288/ + +- name: Set auth_allow_insecure_global_id_reclaim to True + command: + cmd: > + cephadm shell -- + ceph config set mon auth_allow_insecure_global_id_reclaim true + become: true + when: ansible_distribution == "Ubuntu" + - name: Create and initialise pools for OpenStack services command: cmd: > |