the rook-ceph-nvmeof service account is not listed in the
securitycontextconstraints users, causing cephnvmeofgateway
pods to fail on openshift. add the service account to the
scc in the helm charts, go scc builder, and test namespace
substitution.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 7f3e2ace27)
Strip unnecessary leading and trailing newlines from osdLivenessProbeScript and livenessProbeScript raw string literals in spec.go
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 925acb3e92)
We are moving the CSI management to the admin and currently, the
CSI resources are created at runtime so the cluster installed with
helm will face an error that resources are not managed by helm.
To avoid this error, we are adding the annotation at runtime so
that during upgrade users do not face issues.
Signed-off-by: subhamkrai <srai@redhat.com>
When an OSD is purged and reprovisioned, it comes back without the
correct CRUSH device class. NVMe devices configured with
deviceClass: nvme in the CR end up as ssd.
Root cause: the operator sets ROOK_OSD_CRUSH_DEVICE_CLASS on prepare
jobs but not on OSD deployments. During re-discovery
(GetCephVolumeRawOSDs), the daemon reads this env var, finds it
absent, and falls back to auto-detected deviceType which returns ssd
for NVMe.
Fix: add crushDeviceClassEnvVar(osd.DeviceClass) to the OSD
deployment spec in spec.go, alongside the existing
dataDeviceClassEnvVar. Existing deployments pick up the new env var
on operator reconciliation without manual intervention.
Fixes#17227
Signed-off-by: David Orman <ormandj@corenode.com>
(cherry picked from commit 1357d71177)
The mon PDB was previously only being adjusted
during mon failover, where the maxunavailable was set to 0
before failover, then reset to 1 after failover. This allowed
for a race condition where one mon had been drained and is
not fully back in quorum before the next mon is allowed to drain.
This is now prevented by disallowing drains until a mon
is fully back in quorum. Anytime a mon falls out of quorum,
the mon pdb will be adjusted to prevent further drains
from causing a mon quorum outage.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 80b50969b2)
Previously provisionerPriorityClassName config is applied to node plugin
but pluginPriorityClassName is applied to controller plugin. This causes
a misconfiguration since the default values for
provisionerPriorityClassName is system-cluster-critical and
pluginPriorityClassName is system-node-critical.
The default priority for node plugin ought to be system-node-critical so
we can leverage this information to kill the pods in this priority last,
allowing other pods that may mount RBD-backed volume to unmount cleanly
first, otherwise the shutdown sequence may hang due to failure
unmounting RBD-backed volume when the node plugin pod is already killed.
Signed-off-by: Sonny Sasaka <sonnysasaka@gmail.com>
(cherry picked from commit dff04494fe)
This parameter is written to .spec.cephFS.radosNamespace of the generated
ClientProfile.
The parameter is called 'CSIMetadataRadosNamespace' to clarify that it is used
for CSI metadata and unrelated to the actual CephFS (meta)data.
Context:
The ceph-csi CephFS plugin stores additional metadata related to PV(C)s
in RADOS objects in the metadata pool of the CephFS.
By default those objects are stored in the 'csi' RADOS namespace.
For a multi-tenant CephFS setup (that is used by multiple K8s Clusters/
ceph-csi drivers) segregating those additional objects into separate RADOS
namespaces is desireable so the clusters can not modify the metadata of other
clusters (enforced by appropriate ceph client capabilities).
'ceph-csi' implemented this via the `cephFS.radosNamespace` config option for
cluster entries in the `ceph-csi-config` ConfigMap with https://github.com/ceph/ceph-csi/pull/4661.
The `ceph-csi-operator` added support for that config entry by adding
'radosNamespace' to the 'CephFsConfigSpec' of the 'ClientProfile' with
https://github.com/ceph/ceph-csi-operator/pull/165.
Signed-off-by: Alexander Degenhart <degenhart@fim.uni-passau.de>
(cherry picked from commit 17b98da89e)
When osd versions are being detected, log more info
about the versions to understand better if the
require-osd-version release is being set as
expected.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit a80ca49855)
This prevents overwriting the user-specified capabilities
and correctly copies the Capabilities into UserCapabilities
after the AdminOpsClient calls.
Signed-off-by: hjk068 <hello.hyunjin@gmail.com>
(cherry picked from commit b113e37dae)
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
(cherry picked from commit ac6ec79865)
When cephCluster is resinstalled and WipeDevicesFromOtherClusters is set
to true, then Rook cleans up the OSD disks using ceph-volum lvm zap, so
that new OSD can created on this disk. This PR removes the dependencies
of the "ceph-volume lvm zap" and provides implements the entry disk
"ceph-volume lvm zap" logic within rook
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 92324588ba)
deleting an erasure coded CephBlockPool left the ec profile
orphaned. recreating with different settings failed because
the old profile could not be overridden.
- delete ec profile during CephBlockPool deletion
- disable --format json on ec profile set command
- fix ec profile name mismatch in CephObjectStore deletion
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit b88648d10f)
ec pools skip the mirroring configuration path where
the status is set to ready, leaving them stuck in
progressing state forever. add status update to ready
in the else branch when mirroring is skipped.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit ba9fad77a0)
Clean up stale exporter deployments whose target node no longer exists.
This handles the case where the operator was down when a node was deleted,
so the deletion event was missed and the stale deployment was never removed.
Signed-off-by: Muhammad Adil Ghaffar <muhammad.adil.ghaffar@est.tech>
(cherry picked from commit 0b8ed65749)
When reconciling the crash collectors and exporters, if one cluster
has disabled them, they will be deleted, then the reconcile
will complete, thus skipping reconcile of the crash collectors
and exporters for the remaining clusters.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 71e1dbffa4)
Remove the exporter deployment when needed as best effort
in case the removal fails, there is no need to block other
reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 256a338c14)
Rook no longer supports earlier than Ceph v18, so remove the
obsolete version checking in the ceph exporter reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 733406b175)
currently the ipv6 parsing was not done right,
so the ipv6 endpoint was skewed,
It was happening at multiple places for external mode
1) cephobjectstore status
2) cephobjectstoreuser secret
3) and more places where GetAdvertiseEndpointUrl is called
so fixed the GetAdvertiseEndpointUrl func to make use of ipv6 address
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit aa12b5c00c)
the ec pool doesnt support mirroring from ceph end
so skip if the mirroring spec is set on the ec pools
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9f932d477e)
the ceph exporter port was hardcoded to 9926, preventing
co-location of exporters from different ceph clusters on
the same node. add a port field to cephexporterspec so
users can override it via spec.monitoring.exporter.port.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit c2a2fc4241)
The osd unit tests periodically fail with a timing issue
when canceling an orchestration. Attempt to stabilize
the test with a longer timeout before canceling the
test.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 96f4320a34)
In getOSDDiskToBeWiped(), when the RealPath doesn't match the device path reported by ceph-volume, also check each entry in the space-separated DevLinks string. This handles the case where ceph-volume raw list reports an LVM symlink (e.g. /dev/rhel/ceph-data) that differs from the resolved RealPath (e.g. /dev/mapper/rhel-ceph--data).
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 475fc7c7a6)
Updated the following csi sidecars to their latest available versions:
- csi-attacher: v4.11.0
- csi-snapshotter: v8.5.0
- csi-resizer: v2.1.0
- csi-provisioner: v6.1.1
- csi-node-driver-registrar: v2.16.0
Signed-off-by: Praveen M <m.praveen@ibm.com>
(cherry picked from commit 6b55092abf)
Update `lockbox.keyring` rotation for encrypted OSDs to ensure the key
is not lost if the init container fails but continues assuming
(reasonably) that the key is likely still relevant.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 931006fb91)
We should set OSDInfo.DeviceType if "device-type" label is
set on the corresponding Deployment. Otherwise, Rook
deletes this label on Update.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
(cherry picked from commit dac71d9edd)
Adds ImagePullPolicy configuration to CSI node plugin and controller
plugin specs in both the operator config and driver CR generation functions.
This ensures the CSI driver components use the configured pull policy
from CSIParam.ImagePullPolicy.
Signed-off-by: Praveen M <m.praveen@ibm.com>
(cherry picked from commit 67c4203531)
OSDs are created with `ceph-volume lvm batch` if `metadataDevice`
field is specified in CephCluster CR. Since this command does not
support kernel names (e.g. `/dev/dm-X`) for multipath devices,
we should use real names (e.g. `/dev/mapper/mpathX`) instead.
NOTE:
I intentionally keep raw mode OSD creation code as is
because `ceph-volume raw prepare` supports kernel names
for any devices.
Closes: https://github.com/rook/rook/issues/17057
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
(cherry picked from commit 6f8b2aee94)
ensure each gw pod runs on a different node when possible.
add default pod anti-affinity and topology spread constraints.
keep user placement overrides by merging defaults with spec placement.
add tests for default spread and user override behavior.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit bc6e5fbc86)
When http is disabled, the spec.status.info.insecure will keep on
showing the insecure endpoint. This PR makes sure that the
spec.status.info.insecure is empty when http is disabled
Signed-off-by: Santosh <sapillai@redhat.com>
(cherry picked from commit 6b9b0231b7)
Oded Viner
Santosh
Travis Nielsen
subhamkrai
David Orman
Denis Egorenko
Elias Carter
dependabot[bot]
Sonny Sasaka
Alexander Degenhart
Joshua Hoblitt
hjk068
Tarun Gupta Akirala
majiayu000
Niraj Yadav
Artem Torubarov
Muhammad Adil Ghaffar
mergify[bot]
parth-gr
Praveen M
Blaine Gardner
Satoru Takeuchi
subham rai