This commit adds context parameter to k8sutil replicaset and secret
functions. By this, we can handle cancellation during API call of
replicaset and secret resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil service functions. By
this, we can handle cancellation during API call of service resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
We need to use the root UID to run the cleanup job since ceph-volume
does not support running as non-root in all the versions. We have this
ceph tracker to allow this https://tracker.ceph.com/issues/53511 but
it's not in all ceph's versions. Implementing a version check is tricky
since at this stage the cluster is being deleted and it's hard to catch
it.
Closes: https://github.com/rook/rook/issues/9375
Signed-off-by: Sébastien Han <seb@redhat.com>
If cephVersion>= 16.2.7, we run
ceph fs snapshot mirror daemon status
otherwise we run
ceph fs snapshot mirror daemon status <fs_name>
Updating the cmd so both the ceph version can run successfully
Closes: https://github.com/rook/rook/issues/8458
Signed-off-by: parth-gr <paarora@redhat.com>
Fix the CephNFS spec.rados API specifiation to be clear that spec.rados
is optional for all Ceph v16 versions, including that
spec.rados.namespace is optional.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Remove the poolConfig in CephNFS to prevent different CephNFS CRs from
contending to change the replication spec of the default NFS pool.
Resolves#9355
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Let's catch the correct error when no cluster info exists yet. If we
have another error, we fail the orchestration and try again. This could
help up catching small API hiccups for example.
Signed-off-by: Sébastien Han <seb@redhat.com>
Let's have a more accurate and correct error message that reflects what
the failing function tried to do.
Signed-off-by: Sébastien Han <seb@redhat.com>
The failure domain is baked into the crush rule that is
created for a pool. To allow for an updated failure domain
on the pool, create a new crush rule specific for that
failure domain and update the pool with the new rule.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
this should make sure code reuse between the OBC label controller and
the CephBucketNotification controller.
done as part of the cleanup work from:
https://github.com/rook/rook/pull/8426
this also include adding unit tests for:
- topic controller
- notification controller
- obc label controller
Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
The generation of a long node name in the integration tests was
being done based on the k8s version. In the past, older K8s versions
did not support the changing name. Now it's more maintainable if
we generate the long name depending on the test suite.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In K8s 1.22 there is a bug in the job name generation that
the job name is truncated an additional 10 characters. This can cause an issue
in the generated pod name if it then ends in a non-alphanumeric character. In that case,
we more aggressively generate a hashed job name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The failover of the arbiter mon in a stretch cluster was sometimes
failing due to the new tiebreaker not being set in ceph.
Rook would repeatedly try to remove the old tiebreaker mon
and keep failing because the new tiebreaker had not been set.
Now we make setting the tiebreaker idempotent in case the operator
restarts in the middle of the operation or some other corner
case causes the expected tiebreaker to be set. In that case,
the next reconcile will also ensure the tiebreaker mon is
set as expected.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Skipping upgrade checks was not being honored for OSDs.
Now the flag will be checked and allow the OSDs to be upgraded
without checking for the ok-to-stop condition.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit introduces a new configuration option for
ceph csi driver to enable hostpath mounting of /etc/selinux
directory from the cluster node where csi plugin pods are
running, which inturn help the csi driver to specify
selinux-related mount options like context.
Ref# https://github.com/ceph/ceph-csi/issues/2295
The default value for this configuration is true and if cluster
nodes are running without selinux enabled, an admin can deploy
csi pods by specifying this option to `false` which skip the
host path mounting for the csi pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
If we apply useAllNodes to false for the current deployment,
the OSDs should get updated with the individual nodes values and config,
The deviceClass was not updating to the existing OSDs because there was
bug in the check.
The check osdInfo.DeviceClass == "" which should be
checked like this osdInfo.DeviceClass == "None"
Updated the code so OSDs can make use of the devices present
Signed-off-by: parth-gr <paarora@redhat.com>
Sometimes Ceph uses a different standard output to return errors or
merges standard error to standard out. So let's allow some commands to
return both in the output.
Signed-off-by: Sébastien Han <seb@redhat.com>
Some users have reported issues while adding the token, this is not
always reproducable so perhaps it's a typo when importing the token and
adding trailing spaces.
Closes: https://github.com/rook/rook/issues/9151
Signed-off-by: Sébastien Han <seb@redhat.com>
use Zone and ZoneGroup instead of storename for rgw_zone and rgw_zonegroup
Signed-off-by: Olivier Bouffet <olivier.bouffet@infomaniak.com>
(cherry picked from commit c92270cd66)
If multiple removal jobs are fired in parallel, there is a risk of
losing data since we will forcefully remove the OSD. It's also simply
true if a single OSD is not safe to destroy, there is also a risk of
data loss.
So now, we check if the OSD is safe-to-destroy first and then proceed.
The code waits forever and retries every minute unless the
--force-osd-removal flag is passed.
Signed-off-by: Sébastien Han <seb@redhat.com>
Updating the promethes reources (PrometheusRule and ServiceMonitor) is
done by fetching the current resource from the server and updating the
spec on it. This commit makes it also apply the labels, so users can
update them via rook CRDs.
Closes: https://github.com/rook/rook/issues/9241
Signed-off-by: Mara Sophie Grosch <littlefox@lf-net.org>
Previously, if the pool was present we would not run the pool creation
again. This is a problem if the pool spec changes, the new settings will
never be applied.
Signed-off-by: Sébastien Han <seb@redhat.com>
The MKNOD capability was missing and due to recent addition some pod now
only require this cap as well as privileged.
The cap must be explicitly exposed so it can be requested by a pod.
Closes: https://github.com/rook/rook/issues/9234
Signed-off-by: Sébastien Han <seb@redhat.com>
For CRD not using the new nfs spec that includes the pool settings,
applying the "size" property won't work since it is set to 0. The pool
still gets created but returns an error. The loop is re-queued but on
the second run the pool is detected so no further configuration is done.
Closes: https://github.com/rook/rook/issues/9205
Signed-off-by: Sébastien Han <seb@redhat.com>
Clean up the code used to stop health checkers for all controllers
(pool, file, object). Health checkers should now be stopped when
removing the finalizer for a forced deletion when the CephCluster does
not exist. This prevents leaking a running health checker for a resource
that is going to be imminently removed.
Also tidy the health checker stopping code so that it is similar for all
3 controllers. Of note, the object controller now uses namespace and
name for the object health checker, which would create a problem for
users who create a CephObjectStore with the same name in different
namespaces.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The cluster info is important context for the cluster controller to
create the cluster, and all the fields must be properly set.
A test cluster name was being set temporarily, resulting in
mons incorrectly getting the wrong cluster CR name. There is no
known issue from the temporary value, it was just exposed by
https://github.com/rook/rook/pull/8678 setting the value to a label.
Now the functions are more clearly named so only unit and
integration tests should be using the test value for the cluster
name where it is not important.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
the mon cluster clusterInfo is intiated seprately,
and misses out to set the cluster name and use default name as testing
from AdminClusterInfo.
Part-of: https://github.com/rook/rook/issues/9159
Signed-off-by: parth-gr <paarora@redhat.com>
The templates for the mgr-generated ServiceMonitor and PrometheusRule objects included the labels
prometheus and team, making it impossible to override them as user.
This adds a new method `OverwriteApplyToObjectMeta` to
pkg/apis/ceph.rook.io/v1.Labels, which, contrary to the existing
`ApplyToObjectMeta` method, overwrites existing labels.
Closes: https://github.com/rook/rook/issues/8502
Signed-off-by: Mara Sophie Grosch <littlefox@lf-net.org>
The blockdevmapper securityContext was changed to request a minimal set of
required capabilities for its operation and drop running as privileged.
While the base change works and is valid in terms of the container's copy operation,
it turns out that OpenShift may require some additional configuration not
currently covered by the limited securityContext and the capabilities granted.
To not break those OpenShift deployments, make the blkdevmapper securityContext
listen to the ROOK_HOSTPATH_REQUIRES_PRIVILEGED flag again to set privileged mode.
This flag is true on OpenShift deployments and running as privileged
works around the (missing) configuration problem for now.
To properly drop privileged completely some additional investigation needs
to be done on OpenShift deployments without relying on privileged execution.
Signed-off-by: Omar Pakker <Omar007@users.noreply.github.com>
From ceph v16.2.6 onwards the vault TLS suppport in RGW was added,
include similar changes for RGW.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Sébastien Han
Yuichiro Ueno
parth-gr
Blaine Gardner
Travis Nielsen
Yuval Lifshitz
Humble Chirammal
Olivier Bouffet
Mara Sophie Grosch
Omar Pakker
Jiffin Tony Thottan