diff --git a/Documentation/helm-operator.md b/Documentation/helm-operator.md index 9c384edf4..345b2c542 100644 --- a/Documentation/helm-operator.md +++ b/Documentation/helm-operator.md @@ -103,28 +103,29 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the rook-operator chart and their default values. -| Parameter | Description | Default | -| ------------------------- | --------------------------------------------------------------- | ------------------------------------------------------ | -| `image.repository` | Image | `rook/ceph` | -| `image.tag` | Image tag | `master` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `rbacEnable` | If true, create & use RBAC resources | `true` | -| `pspEnable` | If true, create & use PSP resources | `true` | -| `resources` | Pod resource requests & limits | `{}` | -| `annotations` | Pod annotations | `{}` | -| `logLevel` | Global log level | `INFO` | -| `nodeSelector` | Kubernetes `nodeSelector` to add to the Deployment. | | -| `tolerations` | List of Kubernetes `tolerations` to add to the Deployment. | `[]` | -| `agent.flexVolumeDirPath` | Path where the Rook agent discovers the flex volume plugins (*) | `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/` | -| `agent.libModulesDirPath` | Path where the Rook agent should look for kernel modules (*) | `/lib/modules` | -| `agent.mounts` | Additional paths to be mounted in the agent container | | -| `agent.mountSecurityMode` | Mount Security Mode for the agent. | `Any` | -| `agent.toleration` | Toleration for the agent pods | | -| `agent.tolerationKey` | The specific key of the taint to tolerate | | -| `discover.toleration` | Toleration for the discover pods | | -| `discover.tolerationKey` | The specific key of the taint to tolerate | | -| `mon.healthCheckInterval` | The frequency for the operator to check the mon health | `45s` | -| `mon.monOutTimeout` | The time to wait before failing over an unhealthy mon | `300s` | +| Parameter | Description | Default | +| ---------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | +| `image.repository` | Image | `rook/ceph` | +| `image.tag` | Image tag | `master` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `rbacEnable` | If true, create & use RBAC resources | `true` | +| `pspEnable` | If true, create & use PSP resources | `true` | +| `resources` | Pod resource requests & limits | `{}` | +| `annotations` | Pod annotations | `{}` | +| `logLevel` | Global log level | `INFO` | +| `nodeSelector` | Kubernetes `nodeSelector` to add to the Deployment. | | +| `tolerations` | List of Kubernetes `tolerations` to add to the Deployment. | `[]` | +| `hostpathRequiresPrivileged` | Runs Ceph Pods as privileged to be able to write to `hostPath`s in OpenShift with SELinux restrictions. | `false` | +| `agent.flexVolumeDirPath` | Path where the Rook agent discovers the flex volume plugins (*) | `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/` | +| `agent.libModulesDirPath` | Path where the Rook agent should look for kernel modules (*) | `/lib/modules` | +| `agent.mounts` | Additional paths to be mounted in the agent container | | +| `agent.mountSecurityMode` | Mount Security Mode for the agent. | `Any` | +| `agent.toleration` | Toleration for the agent pods | | +| `agent.tolerationKey` | The specific key of the taint to tolerate | | +| `discover.toleration` | Toleration for the discover pods | | +| `discover.tolerationKey` | The specific key of the taint to tolerate | | +| `mon.healthCheckInterval` | The frequency for the operator to check the mon health | `45s` | +| `mon.monOutTimeout` | The time to wait before failing over an unhealthy mon | `300s` | * For information on what to set `agent.flexVolumeDirPath` to, please refer to the [Rook flexvolume documentation](flexvolume.md) * `agent.mounts` should have this format `mountname1=/host/path:/container/path,mountname2=/host/path2:/container/path2` diff --git a/cluster/charts/rook-ceph/templates/deployment.yaml b/cluster/charts/rook-ceph/templates/deployment.yaml index 13c6a7635..67cf9107c 100644 --- a/cluster/charts/rook-ceph/templates/deployment.yaml +++ b/cluster/charts/rook-ceph/templates/deployment.yaml @@ -66,6 +66,10 @@ spec: - name: DISCOVER_TOLERATION_KEY value: {{ .Values.discover.tolerationKey }} {{- end }} +{{- end }} +{{- if .Values.hostpathRequiresPrivileged }} + - name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED + value: {{ .Values.hostpathRequiresPrivileged }} {{- end }} - name: ROOK_LOG_LEVEL value: {{ .Values.logLevel }} diff --git a/cluster/charts/rook-ceph/values.yaml.tmpl b/cluster/charts/rook-ceph/values.yaml.tmpl index c628928d9..690265502 100644 --- a/cluster/charts/rook-ceph/values.yaml.tmpl +++ b/cluster/charts/rook-ceph/values.yaml.tmpl @@ -72,3 +72,7 @@ pspEnable: true # Disable it here if you have similar issues. # For more details see https://github.com/rook/rook/issues/2417 enableSelinuxRelabeling: true + +# Writing to the hostPath is required for the Ceph mon and osd pods. Given the restricted permissions in OpenShift with SELinux, +# the pod must be running privileged in order to write to the hostPath volume, this must be set to true then. +hostpathRequiresPrivileged: false