From 638cc3a503fb58be4604d4e508a82fd2a3f08562 Mon Sep 17 00:00:00 2001 From: Sunnatillo Date: Fri, 17 Oct 2025 12:42:43 +0300 Subject: [PATCH] mgr: add hostNetwork field to Manager spec Add optinal hostnetwork field for Ceph Mgr to control whether the mgr pods to run in host network. If unset, this defaults to cluster level Network.HostNetwork value. This particulary useful when user wants to restrict ceph mgr pod from exposing metrics port in all host interfaces. Signed-off-by: Sunnatillo (cherry picked from commit b9a4685f6533ccbb7e167085291fd1366d242b08) --- Documentation/CRDs/specification.md | 12 ++++ .../charts/rook-ceph/templates/resources.yaml | 3 + deploy/examples/crds.yaml | 3 + pkg/apis/ceph.rook.io/v1/types.go | 3 + .../ceph.rook.io/v1/zz_generated.deepcopy.go | 5 ++ pkg/operator/ceph/cluster/mgr/spec.go | 14 +++- pkg/operator/ceph/cluster/mgr/spec_test.go | 69 +++++++++++++++++++ 7 files changed, 107 insertions(+), 2 deletions(-) diff --git a/Documentation/CRDs/specification.md b/Documentation/CRDs/specification.md index b1777f559..ee93f9065 100644 --- a/Documentation/CRDs/specification.md +++ b/Documentation/CRDs/specification.md @@ -9113,6 +9113,18 @@ bool

Modules is the list of ceph manager modules to enable/disable

+ + +hostNetwork
+ +bool + + + +(Optional) +

Whether host networking is enabled for the Ceph Mgr. If not set, the network settings from CephCluster.spec.networking will be applied.

+ +

Migration diff --git a/deploy/charts/rook-ceph/templates/resources.yaml b/deploy/charts/rook-ceph/templates/resources.yaml index 5635c9901..797d3e7a3 100644 --- a/deploy/charts/rook-ceph/templates/resources.yaml +++ b/deploy/charts/rook-ceph/templates/resources.yaml @@ -2126,6 +2126,9 @@ spec: maximum: 5 minimum: 0 type: integer + hostNetwork: + description: Whether host networking is enabled for the Ceph Mgr. If not set, the network settings from CephCluster.spec.networking will be applied. + type: boolean modules: description: Modules is the list of ceph manager modules to enable/disable items: diff --git a/deploy/examples/crds.yaml b/deploy/examples/crds.yaml index 0ffac0f0d..8f6c0684f 100644 --- a/deploy/examples/crds.yaml +++ b/deploy/examples/crds.yaml @@ -2124,6 +2124,9 @@ spec: maximum: 5 minimum: 0 type: integer + hostNetwork: + description: Whether host networking is enabled for the Ceph Mgr. If not set, the network settings from CephCluster.spec.networking will be applied. + type: boolean modules: description: Modules is the list of ceph manager modules to enable/disable items: diff --git a/pkg/apis/ceph.rook.io/v1/types.go b/pkg/apis/ceph.rook.io/v1/types.go index a0f190515..1a6183460 100755 --- a/pkg/apis/ceph.rook.io/v1/types.go +++ b/pkg/apis/ceph.rook.io/v1/types.go @@ -854,6 +854,9 @@ type MgrSpec struct { // +optional // +nullable Modules []Module `json:"modules,omitempty"` + // Whether host networking is enabled for the Ceph Mgr. If not set, the network settings from CephCluster.spec.networking will be applied. + // +optional + HostNetwork *bool `json:"hostNetwork,omitempty"` } // Module represents mgr modules that the user wants to enable or disable diff --git a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go index 44f197742..dc4fc5f2b 100644 --- a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go +++ b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go @@ -3338,6 +3338,11 @@ func (in *MgrSpec) DeepCopyInto(out *MgrSpec) { *out = make([]Module, len(*in)) copy(*out, *in) } + if in.HostNetwork != nil { + in, out := &in.HostNetwork, &out.HostNetwork + *out = new(bool) + **out = **in + } return } diff --git a/pkg/operator/ceph/cluster/mgr/spec.go b/pkg/operator/ceph/cluster/mgr/spec.go index 5d309166a..4f77f53ea 100644 --- a/pkg/operator/ceph/cluster/mgr/spec.go +++ b/pkg/operator/ceph/cluster/mgr/spec.go @@ -48,7 +48,7 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error) adminKeyringVol, _ := keyring.Volume().Admin(), keyring.VolumeMount().Admin() volumes = append(volumes, adminKeyringVol) } - + hostNetwork := isHostNetworkEnabled(c) podSpec := v1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ Name: mgrConfig.ResourceName, @@ -65,7 +65,7 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error) ServiceAccountName: serviceAccountName, RestartPolicy: v1.RestartPolicyAlways, Volumes: volumes, - HostNetwork: c.spec.Network.IsHost(), + HostNetwork: hostNetwork, PriorityClassName: cephv1.GetMgrPriorityClassName(c.spec.PriorityClassNames), }, } @@ -396,3 +396,13 @@ func (c *Cluster) buildSelectorLabels(labels map[string]string) map[string]strin selectorLabels["mgr_role"] = "active" return selectorLabels } + +// isHostNetworkEnabled checks if hostNetwork field is set in mgr spec, if not +// gets it from Cluster Spec +func isHostNetworkEnabled(c *Cluster) bool { + hostNetwork := c.spec.Network.IsHost() + if c.spec.Mgr.HostNetwork != nil { + hostNetwork = *c.spec.Mgr.HostNetwork + } + return hostNetwork +} diff --git a/pkg/operator/ceph/cluster/mgr/spec_test.go b/pkg/operator/ceph/cluster/mgr/spec_test.go index 0e8a7453f..4fecdb6c6 100644 --- a/pkg/operator/ceph/cluster/mgr/spec_test.go +++ b/pkg/operator/ceph/cluster/mgr/spec_test.go @@ -191,3 +191,72 @@ func TestApplyPrometheusAnnotations(t *testing.T) { assert.Equal(t, 1, len(c.spec.Annotations)) assert.Equal(t, 0, len(d.ObjectMeta.Annotations)) } + +func TestMgrNetwork(t *testing.T) { + clientset := optest.New(t, 1) + ownerInfo := cephclient.NewMinimumOwnerInfoWithOwnerRef() + clusterInfo := &cephclient.ClusterInfo{Namespace: "ns", FSID: "myfsid", OwnerInfo: ownerInfo} + clusterInfo.SetName("test") + ptrToFalse := false + ptrToTrue := true + + mgrTestConfig := mgrConfig{ + DaemonID: "a", + ResourceName: "mgr-a", + DataPathMap: config.NewStatelessDaemonDataPathMap(config.MgrType, "a", "rook-ceph", "/var/lib/rook/"), + } + + t.Run("cluster HostNetwork true, manager Hostnetwork false", func(t *testing.T) { + clusterSpec := cephv1.ClusterSpec{ + Network: cephv1.NetworkSpec{HostNetwork: true}, + Mgr: cephv1.MgrSpec{HostNetwork: &ptrToFalse}, + } + c := New(&clusterd.Context{Clientset: clientset}, clusterInfo, clusterSpec, "myversion") + + d, err := c.makeDeployment(&mgrTestConfig) + assert.NoError(t, err) + assert.NotNil(t, d) + + assert.Equal(t, false, d.Spec.Template.Spec.HostNetwork) + }) + + t.Run("cluster hostNetwork true, manager hostnetwork true", func(t *testing.T) { + clusterSpec := cephv1.ClusterSpec{ + Network: cephv1.NetworkSpec{HostNetwork: true}, + Mgr: cephv1.MgrSpec{HostNetwork: &ptrToTrue}, + } + c := New(&clusterd.Context{Clientset: clientset}, clusterInfo, clusterSpec, "myversion") + + d, err := c.makeDeployment(&mgrTestConfig) + assert.NoError(t, err) + assert.NotNil(t, d) + + assert.Equal(t, true, d.Spec.Template.Spec.HostNetwork) + }) + t.Run("cluster hostNetwork false, manager hostnetwork empty", func(t *testing.T) { + clusterSpec := cephv1.ClusterSpec{ + Network: cephv1.NetworkSpec{HostNetwork: false}, + // Mgr: cephv1.MgrSpec{HostNetwork: &ptrToTrue}, + } + c := New(&clusterd.Context{Clientset: clientset}, clusterInfo, clusterSpec, "myversion") + + d, err := c.makeDeployment(&mgrTestConfig) + assert.NoError(t, err) + assert.NotNil(t, d) + + assert.Equal(t, false, d.Spec.Template.Spec.HostNetwork) + }) + t.Run("cluster hostNetwork true manager hostnetwork empty", func(t *testing.T) { + clusterSpec := cephv1.ClusterSpec{ + Network: cephv1.NetworkSpec{HostNetwork: true}, + // Mgr: cephv1.MgrSpec{HostNetwork: &ptrToTrue}, + } + c := New(&clusterd.Context{Clientset: clientset}, clusterInfo, clusterSpec, "myversion") + + d, err := c.makeDeployment(&mgrTestConfig) + assert.NoError(t, err) + assert.NotNil(t, d) + + assert.Equal(t, true, d.Spec.Template.Spec.HostNetwork) + }) +}