ceph: manage /etc/ceph/ceph.conf on osd and mon/mgr/mds hosts

Bring the hand-maintained /etc/ceph/ceph.conf under Puppet on the
prodnxsr ceph cluster (fsid de96a98f). The file is identified per host
by role: k8s roles include profiles::ceph::osd only and get a [global]
section; the incus node role also includes profiles::ceph::mds and
additionally gets the [mds] + [mds.*] sections.

- Add cluster topology as a single source of truth in common.yaml:
  cluster_public_ips (all 13 ceph host /32s), mon_initial_members, and
  the mds_instances map (two mds daemons per mon/mgr/mds host).
- Render /etc/ceph/ceph.conf from that topology in the reworked
  client.conf.erb, preserving the live two-space indent and key order.
- Gate the [mds] sections on render_mds_config, set true only in the
  incus node role hiera (the role that includes profiles::ceph::mds).
- Drop the hard Package[ceph-common] dependency when the class does not
  manage the package (cephadm/profiles::packages deliver it on the k8s
  and incus hosts).
- Enable manage_ceph_conf on the k8s and incus node roles.

public_network is normalized to all 13 ceph host /32s on every host;
this rewrites it on the mon/mgr/mds hosts (adding .1-.8) as the one
intended content change. RGW hosts keep their profiles::ceph::conf
variant and are untouched.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

site/profiles/manifests/ceph/client.pp

@@ -2,6 +2,9 @@
 class profiles::ceph::client (
   String $fsid,
   Array[Stdlib::Host] $mons,
+  # cluster topology (single source of truth: hieradata/common.yaml)
+  Array[Stdlib::Host] $cluster_public_ips,
+  Array[Stdlib::Host] $mon_initial_members,
   Stdlib::Absolutepath $config_file = '/etc/ceph/ceph.conf',
   Boolean $manage_ceph_conf = true,
   Boolean $manage_ceph_package = true,
@@ -10,6 +13,24 @@ class profiles::ceph::client (
   String $group = 'ceph',
   Stdlib::Filemode $mode = '0644',
   Hash $keyrings = {},
+  # [global] tunables (defaults match the live hand-maintained ceph.conf)
+  String $auth_client_required = 'cephx',
+  String $auth_cluster_required = 'cephx',
+  String $auth_service_required = 'cephx',
+  Boolean $mon_allow_pool_delete = true,
+  Boolean $ms_bind_ipv4 = true,
+  Boolean $ms_bind_ipv6 = false,
+  Integer $osd_crush_chooseleaf_type = 1,
+  Integer $osd_pool_default_min_size = 2,
+  Integer $osd_pool_default_size = 3,
+  Integer $osd_pool_default_pg_num = 128,
+  # mds config sections; only rendered on mon/mgr/mds hosts (render_mds_config)
+  Boolean $render_mds_config = false,
+  Hash[String, Integer] $mds_instances = {},
+  Hash $mds_common = {
+    'keyring'            => '/var/lib/ceph/mds/ceph-$id/keyring',
+    'mds_standby_replay' => true,
+  },
 ) {
 
   # dont run this on proxmox nodes
@@ -22,6 +43,13 @@ class profiles::ceph::client (
       }
     }
 
+    # only depend on the package when this class manages it; on the ceph
+    # hosts the package is delivered by cephadm / profiles::packages instead.
+    $config_require = $manage_ceph_package ? {
+      true    => Package['ceph-common'],
+      default => undef,
+    }
+
     # manage the ceph directory
     if $manage_ceph_paths {
       file { '/etc/ceph':
@@ -29,11 +57,11 @@ class profiles::ceph::client (
         owner   => $owner,
         group   => $group,
         mode    => $mode,
-        require => Package['ceph-common'],
+        require => $config_require,
       }
     }
 
-    # create a basic client config
+    # render /etc/ceph/ceph.conf from cluster topology in hiera
     if $manage_ceph_conf {
       file { $config_file:
         ensure  => file,
@@ -41,7 +69,7 @@ class profiles::ceph::client (
         group   => $group,
         mode    => $mode,
         content => template('profiles/ceph/client.conf.erb'),
-        require => Package['ceph-common'],
+        require => $config_require,
       }
     }
 

site/profiles/templates/ceph/client.conf.erb

@@ -1,3 +1,26 @@
 [global]
-	fsid = <%= @fsid %>
-	mon_host = <%= @mons.join(' ') %>
+  auth_client_required = <%= @auth_client_required %>
+  auth_cluster_required = <%= @auth_cluster_required %>
+  auth_service_required = <%= @auth_service_required %>
+  fsid = <%= @fsid %>
+  mon_allow_pool_delete = <%= @mon_allow_pool_delete %>
+  mon_initial_members = <%= @mon_initial_members.join(',') %>
+  mon_host = <%= @mons.join(',') %>
+  ms_bind_ipv4 = <%= @ms_bind_ipv4 %>
+  ms_bind_ipv6 = <%= @ms_bind_ipv6 %>
+  osd_crush_chooseleaf_type = <%= @osd_crush_chooseleaf_type %>
+  osd_pool_default_min_size = <%= @osd_pool_default_min_size %>
+  osd_pool_default_size = <%= @osd_pool_default_size %>
+  osd_pool_default_pg_num = <%= @osd_pool_default_pg_num %>
+  public_network = <%= @cluster_public_ips.map { |ip| "#{ip}/32" }.join(',') %>
+<% if @render_mds_config -%>
+[mds]
+  keyring = <%= @mds_common['keyring'] %>
+  mds_standby_replay = <%= @mds_common['mds_standby_replay'] %>
+<% @mds_instances.sort.each do |host, count| -%>
+<% (1..count).each do |instance| -%>
+[mds.<%= host %>-<%= instance %>]
+  host = <%= host %>
+<% end -%>
+<% end -%>
+<% end -%>