the rook-ceph-nvmeof service account is not listed in the
securitycontextconstraints users, causing cephnvmeofgateway
pods to fail on openshift. add the service account to the
scc in the helm charts, go scc builder, and test namespace
substitution.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 7f3e2ace27)
Strip unnecessary leading and trailing newlines from osdLivenessProbeScript and livenessProbeScript raw string literals in spec.go
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 925acb3e92)
We are moving the CSI management to the admin and currently, the
CSI resources are created at runtime so the cluster installed with
helm will face an error that resources are not managed by helm.
To avoid this error, we are adding the annotation at runtime so
that during upgrade users do not face issues.
Signed-off-by: subhamkrai <srai@redhat.com>
When an OSD is purged and reprovisioned, it comes back without the
correct CRUSH device class. NVMe devices configured with
deviceClass: nvme in the CR end up as ssd.
Root cause: the operator sets ROOK_OSD_CRUSH_DEVICE_CLASS on prepare
jobs but not on OSD deployments. During re-discovery
(GetCephVolumeRawOSDs), the daemon reads this env var, finds it
absent, and falls back to auto-detected deviceType which returns ssd
for NVMe.
Fix: add crushDeviceClassEnvVar(osd.DeviceClass) to the OSD
deployment spec in spec.go, alongside the existing
dataDeviceClassEnvVar. Existing deployments pick up the new env var
on operator reconciliation without manual intervention.
Fixes#17227
Signed-off-by: David Orman <ormandj@corenode.com>
(cherry picked from commit 1357d71177)
The mon PDB was previously only being adjusted
during mon failover, where the maxunavailable was set to 0
before failover, then reset to 1 after failover. This allowed
for a race condition where one mon had been drained and is
not fully back in quorum before the next mon is allowed to drain.
This is now prevented by disallowing drains until a mon
is fully back in quorum. Anytime a mon falls out of quorum,
the mon pdb will be adjusted to prevent further drains
from causing a mon quorum outage.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 80b50969b2)
Previously the unreachable node toleration on the operator pod was hardcoded to 5 seconds in the Helm chart and the ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS env var was notset up at all. This change reads both from .Values.unreachableNodeTolerationSeconds (defaulting to 5).
Fixes#17303
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
(cherry picked from commit dcb501de56)
Previously provisionerPriorityClassName config is applied to node plugin
but pluginPriorityClassName is applied to controller plugin. This causes
a misconfiguration since the default values for
provisionerPriorityClassName is system-cluster-critical and
pluginPriorityClassName is system-node-critical.
The default priority for node plugin ought to be system-node-critical so
we can leverage this information to kill the pods in this priority last,
allowing other pods that may mount RBD-backed volume to unmount cleanly
first, otherwise the shutdown sequence may hang due to failure
unmounting RBD-backed volume when the node plugin pod is already killed.
Signed-off-by: Sonny Sasaka <sonnysasaka@gmail.com>
(cherry picked from commit dff04494fe)
This parameter is written to .spec.cephFS.radosNamespace of the generated
ClientProfile.
The parameter is called 'CSIMetadataRadosNamespace' to clarify that it is used
for CSI metadata and unrelated to the actual CephFS (meta)data.
Context:
The ceph-csi CephFS plugin stores additional metadata related to PV(C)s
in RADOS objects in the metadata pool of the CephFS.
By default those objects are stored in the 'csi' RADOS namespace.
For a multi-tenant CephFS setup (that is used by multiple K8s Clusters/
ceph-csi drivers) segregating those additional objects into separate RADOS
namespaces is desireable so the clusters can not modify the metadata of other
clusters (enforced by appropriate ceph client capabilities).
'ceph-csi' implemented this via the `cephFS.radosNamespace` config option for
cluster entries in the `ceph-csi-config` ConfigMap with https://github.com/ceph/ceph-csi/pull/4661.
The `ceph-csi-operator` added support for that config entry by adding
'radosNamespace' to the 'CephFsConfigSpec' of the 'ClientProfile' with
https://github.com/ceph/ceph-csi-operator/pull/165.
Signed-off-by: Alexander Degenhart <degenhart@fim.uni-passau.de>
(cherry picked from commit 17b98da89e)
As discussed in the community meeting, wait until the next Rook
minor release v1.20 to change the default Ceph version to
tentacle v20. While v20 is already supported with v1.19.x,
we will just wait to change the default version in Rook.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
References the standalone cleanup-job.yaml for cases where the
operator-managed cleanup did not run on a specific node.
Signed-off-by: Mateen Anjum <mateenali66@gmail.com>
(cherry picked from commit 5219e81538)
Add a standalone Job manifest mirroring the cleanup logic the operator
executes via cleanUpJobTemplateSpec when a CephCluster is deleted with
cleanupPolicy enabled.
Useful when the operator-managed cleanup did not run (e.g. force-deleted
cluster) or a node needs manual cleanup outside normal operator flow.
Secrets (ROOK_MON_SECRET, ROOK_CLUSTER_FSID) are sourced from the
rook-ceph-mon secret via secretKeyRef. Namespace is injected via the
Downward API. Only dataDirHostPath and node hostname need manual input.
Closes#17255
Signed-off-by: Mateen Anjum <mateenali66@gmail.com>
(cherry picked from commit e3b4217458)
When osd versions are being detected, log more info
about the versions to understand better if the
require-osd-version release is being set as
expected.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit a80ca49855)
This prevents overwriting the user-specified capabilities
and correctly copies the Capabilities into UserCapabilities
after the AdminOpsClient calls.
Signed-off-by: hjk068 <hello.hyunjin@gmail.com>
(cherry picked from commit b113e37dae)
This factors out the creation of a single CephObjectStore instance to be
shared between the individually namespaced object suite packages.
This reduces the object suite runtime by the cost of starting up and
tearing down an object store three times.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 92f6d3fb67)
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
(cherry picked from commit ac6ec79865)
When cephCluster is resinstalled and WipeDevicesFromOtherClusters is set
to true, then Rook cleans up the OSD disks using ceph-volum lvm zap, so
that new OSD can created on this disk. This PR removes the dependencies
of the "ceph-volume lvm zap" and provides implements the entry disk
"ceph-volume lvm zap" logic within rook
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 92324588ba)
Michael Adam
Travis Nielsen
Oded Viner
mergify[bot]
Santosh
subhamkrai
David Orman
Denis Egorenko
Elias Carter
dependabot[bot]
Prabhala Tara Aasrita
subham rai
Sonny Sasaka
Alexander Degenhart
Joshua Hoblitt
Artem Muterko
Daniel Gonzalez
Mateen Anjum
Joshua Hoblitt
hjk068
Blaine Gardner
Tarun Gupta Akirala
majiayu000