Some operator settings can be applied dynamically in a configmap
instead of requiring the operator to restart. While these settings
may be infrequently updated, applying these settings in the configmap
can avoid an unnecessary operator restart. This will also make the
operator deployment more consistent with the non-helm install.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Previously, we were ignoring configuration changes coming from the
operator's pod env variables. We were assuming most users were using the
operator configmap "rook-ceph-operator-config" but most Helm users
don't. Now we will reconcile if a cephcluster is found during a CREATE
event (can be an operator restart or a cephcluster creation) AND no
"rook-ceph-operator-config" is found which means the operator's pod env
var are used.
Also, unit tests have been added (long due) for the predicate!
Closes: #9602, #9487, #9579
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit restrict csiaddons to open only 1 port
as per the requirement which is required for security.
Fixes: #9604
Signed-off-by: yati1998 <ypadia@redhat.com>
add annotations to secrets and configmaps to use
different tools to sync secrets and configmap.
Currently, these annotation is applied only on
the `rook-ceph-mon-endpoints` configmap and
the secrets `rook-ceph-mon` and `rook-ceph-admin-keyring`.
Closes: https://github.com/rook/rook/issues/8999
Signed-off-by: subhamkrai <srai@redhat.com>
Even though mention about keda 2.x version, the scaledObject.yaml or
rgw-keda.yaml referring to older keda CRs
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The CSI users created by the external script(both for rbd and cephfs)
need the blocklist capability so the CSI pods can execute the
`osd blocklist` commands for metro DR
update the mon caps of csi users with `profile simple-rados-client-with-blocklist`
so they have privileges to run osd blocklist cmds
Closes: https://issues.redhat.com/browse/RHSTOR-2451
Signed-off-by: parth-gr <paarora@redhat.com>
Simply applying `LC_ALL=C` will work for the current shell only. For all
the shells and sub-shell to use it, we must set it globally.
Making it the first thing in the Make entrypoint now so the CRD and RBAC
sorting works on all the platforms.
Signed-off-by: Sébastien Han <seb@redhat.com>
Below sidecars are updated to the latest releases with this commit.
csi-provisioner : 3.1.0
csi-attacher : 3.4.0
node-driver-registrar: 2.4.0
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Linux doesn't guarantee file ordering, so when dealing with files in
order, we can use 'sort' to make sure the order is deterministic. For
yq's usage of files, we need to keep file names in an intermediate
variable, and this should be an array to support file paths with spaces.
'readarray' is not available on MacOS's built-in bash, so a longer
'while read' loop is needed for the array creation.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
When the active mgr changes, there may be user-created services
that also need to have their selector updated to point to the
new active mgr. Now the operator will update any service in the
rook operator namespace that has the label app=rook-ceph-mgr
to point to the active mgr.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The helm tests were previously only for new installs, and did
not have an upgrade path. Now the upgrade path is tested
to give confidence in the helm upgrades.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The test suites were triggered by Jenkins potentially
using different versions of K8s and environment variables.
There is no longer a need for these environment vars to
determine which test suites should be run. The test
suites to run can just be triggered directly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Previously we were using the namespace, it's a mistake, even though most
clusters use the same name as the namespace.
Let's be precise and use the cluster name when looking for it.
Signed-off-by: Sébastien Han <seb@redhat.com>
right now the RoleBinding for monitoring is created with the cluster namespace as the subject
this causes the operator to loop on reconcile due to it not having permissions to create monitors
in the other cluster
moving the subject to the operator namespace fixes this
Signed-off-by: Henry Zhang <me@henry.dev>
The colon character is not allowed in secret names, therfore the secret
with the subuser credentials must use another character to join the
user and the subuser name.
This in turn makes the mapping non-injective (which has security
implications).
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Travis Nielsen
Blaine Gardner
Sébastien Han
Madhu Rajanna
Satoru Takeuchi
yati1998
subhamkrai
Jiffin Tony Thottan
parth-gr
Humble Chirammal
Sebastian Riese
Yuval Lifshitz
Henry Zhang
dependabot[bot]