the rook-ceph-nvmeof service account is not listed in the
securitycontextconstraints users, causing cephnvmeofgateway
pods to fail on openshift. add the service account to the
scc in the helm charts, go scc builder, and test namespace
substitution.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 7f3e2ace27)
Previously the unreachable node toleration on the operator pod was hardcoded to 5 seconds in the Helm chart and the ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS env var was notset up at all. This change reads both from .Values.unreachableNodeTolerationSeconds (defaulting to 5).
Fixes#17303
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
(cherry picked from commit dcb501de56)
This parameter is written to .spec.cephFS.radosNamespace of the generated
ClientProfile.
The parameter is called 'CSIMetadataRadosNamespace' to clarify that it is used
for CSI metadata and unrelated to the actual CephFS (meta)data.
Context:
The ceph-csi CephFS plugin stores additional metadata related to PV(C)s
in RADOS objects in the metadata pool of the CephFS.
By default those objects are stored in the 'csi' RADOS namespace.
For a multi-tenant CephFS setup (that is used by multiple K8s Clusters/
ceph-csi drivers) segregating those additional objects into separate RADOS
namespaces is desireable so the clusters can not modify the metadata of other
clusters (enforced by appropriate ceph client capabilities).
'ceph-csi' implemented this via the `cephFS.radosNamespace` config option for
cluster entries in the `ceph-csi-config` ConfigMap with https://github.com/ceph/ceph-csi/pull/4661.
The `ceph-csi-operator` added support for that config entry by adding
'radosNamespace' to the 'CephFsConfigSpec' of the 'ClientProfile' with
https://github.com/ceph/ceph-csi-operator/pull/165.
Signed-off-by: Alexander Degenhart <degenhart@fim.uni-passau.de>
(cherry picked from commit 17b98da89e)
As discussed in the community meeting, wait until the next Rook
minor release v1.20 to change the default Ceph version to
tentacle v20. While v20 is already supported with v1.19.x,
we will just wait to change the default version in Rook.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add a standalone Job manifest mirroring the cleanup logic the operator
executes via cleanUpJobTemplateSpec when a CephCluster is deleted with
cleanupPolicy enabled.
Useful when the operator-managed cleanup did not run (e.g. force-deleted
cluster) or a node needs manual cleanup outside normal operator flow.
Secrets (ROOK_MON_SECRET, ROOK_CLUSTER_FSID) are sourced from the
rook-ceph-mon secret via secretKeyRef. Namespace is injected via the
Downward API. Only dataDirHostPath and node hostname need manual input.
Closes#17255
Signed-off-by: Mateen Anjum <mateenali66@gmail.com>
(cherry picked from commit e3b4217458)
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
(cherry picked from commit ac6ec79865)
With the release of the ceph csi operator v0.6.0,
update the helm chart dependency that was missed when
the csi-operator.yaml manifest was updated.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit ed7daa61e6)
There is no need to manually deploy Ceph-CSI/NVMe-oF anymore, the YAMLs
can be removed as the example operator.yaml includes the options now.
Signed-off-by: Niels de Vos <ndevos@ibm.com>
(cherry picked from commit 02ed13afa0)
The latest release of ceph-csi-operator is able to deploy
Ceph-CSI/NVMe-oF.
Signed-off-by: Niels de Vos <ndevos@ibm.com>
(cherry picked from commit 5930866833)
the ceph exporter port was hardcoded to 9926, preventing
co-location of exporters from different ceph clusters on
the same node. add a port field to cephexporterspec so
users can override it via spec.monitoring.exporter.port.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit c2a2fc4241)
The helm chart will allow setting annotations and labels
in the CephCluster CR via the helm settings in values.yaml
named cephClusterMetadata.
Signed-off-by: Mathieu Parent <mathieu.parent@insee.fr>
(cherry picked from commit 1e4e31fa79)
Updated the following csi sidecars to their latest available versions:
- csi-attacher: v4.11.0
- csi-snapshotter: v8.5.0
- csi-resizer: v2.1.0
- csi-provisioner: v6.1.1
- csi-node-driver-registrar: v2.16.0
Signed-off-by: Praveen M <m.praveen@ibm.com>
(cherry picked from commit 6b55092abf)
when cluster is deployed in namespace other than rook-ceph,
csi-operator.yaml should also follow similar approach on how
rook operator.yaml and other yaml are updated to deploy in
alternate namespace using the comment `# namesapce: operator`.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 3f0b92a1cc)
adds a new nvmeof minikube canary job for ceph v20.
the test deploys rook with csi operator disabled for nvmeof flow.
it validates pvc and pod io, gateway restart, and data persistence.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 2ebb5d968a)
with controller runtime latest version vO.23.0, golangci lint
is complaining about deprecated api deprecated.
This commit updates the api and adds the requried rbacs
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 08344f39f6)
add expand secrets and set volume expansion in examples
update provisioner and resizer images to canary
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 83c0b98418)
since node fencing is disabled in rook for sometime
and this feature is implemented in csi. So, this
commits remove obsolete code related to node loss
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 20f350a71a)
# Conflicts:
# pkg/operator/ceph/cluster/watcher_test.go
It has only been used by the flex driver which is long gone.
This removes the nodes/proxy RBAC grant from the helm chart, the example
YAMl and the security design docs.
Signed-off-by: Tobias Florek <me@ibotty.net>
(cherry picked from commit db814dcd4b)
The image pull policy was expected to be set in the cephcluster
CR or else the helm deployment would fail. Now we set the expected
default to pull if not present.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 090fc3c369)
The setting for concurrent clusters is now available in the
helm chart, instead of only as an env var on the operator
deployment. reconcileConcurrentClusters will be applied to the
env var ROOK_RECONCILE_CONCURRENT_CLUSTERS.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 52393923d1)
Michael Adam
Oded Viner
Elias Carter
Prabhala Tara Aasrita
Alexander Degenhart
Joshua Hoblitt
Travis Nielsen
Daniel Gonzalez
subhamkrai
Mateen Anjum
Tarun Gupta Akirala
majiayu000
Niels de Vos
Niraj Yadav
Artem Torubarov
Mathieu Parent
mergify[bot]
Praveen M
Joshua Hoblitt
dependabot[bot]
subham rai
Tobias Florek