This commit adds seccomp annotations to the PSP shipped with Rook
Operator. In this way the operator when deployed will be more secure and
will only be allowed the syscalls defined the runtime's seccomp profile.
Signed-off-by: Suraj Deshmukh <surajd.service@gmail.com>
Previously, the rbd-mirror daemon was integrated into the `CephCluster`
CRD. This wasn't really practical since we would have to wait for the
whole orchestration to be done to actually set it up. The same goes for
any CR update. Let's say you want to change the number of daemons, Rook
would go through mons, mgrs and osds until it get to rbd-mirror.
This triggers an undesired full orchestration.
With its own CRD this component just gains a lot more flexibility.
Closes: https://github.com/rook/rook/issues/5084
Signed-off-by: Sébastien Han <seb@redhat.com>
With the release of the CSI v2.0.1 driver, this should now be the
default driver deployed by Rook. The minimum driver version
supported is still v2.0.0
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Update cephcsi driver to v2.0.1 to allow nodes with
Ceph persistent volumes to shutdown cleanly. This requires
an additional bind mount (/run/mount) in cephfsplugin
and rbdplugin templates.
Signed-off-by: Chu Yong Mark Lee <markleechuyong@gmail.com>
You can now use Rook along with Multus. Multus must be up and running
and the right ressources must exist such as NetworkAttachmentDefinition
CR.
The Cluster CR spec has new fields to work with multus:
network:
provider: multus (or 'host' for hostNetworking)
selectors:
public: NetworkAttachmentDefinition name
cluster: NetworkAttachmentDefinition name
If only a single NetworkAttachmentDefinition is provided Rook will use
both anyway for the Ceph traffic.
Please refer to the doc to learn more.
Closes: https://github.com/rook/rook/issues/4716
Signed-off-by: Sébastien Han <seb@redhat.com>
Some versions of k8s can optionally enable extensions after deprecation.
This could lead to rbac denials when trying to perform operations on deployments
Signed-off-by: Rohan CJ <rohantmp@gmail.com>
Fix the following error message due to unnecessary whitespaces.
```console
$ kubectl create -f cluster-on-pvc.yaml
error: error parsing cluster-on-pvc.yaml: error converting YAML to JSON: yaml: line 85: mapping values are not allowed in this context
```
Closes: #5149
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Update both documents and `upgrade-from-v1.2*.yaml` files for Rook v1.3
release.
Of note:
- note when the upgrade to CSI driver v2.0 should be updated
- note that CSI image envs can be removed to have Rook use defaults
- update Ceph version upgrade section
- update supported Ceph version info
- update CRDs before upgrade b/c new 'status' fields
- remove special CSI update info left from v1.2
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
(cherry picked from commit 2ccff83d94)
In order to perform full automation of cephcluster deletion safely
and protect against catastrophic data loss, the end user must be
able to signify that they intend to irrecoverably delete the data
in their cluster. The cleanupPolicy field of the cluster spec is
intended to communicate this. This patch does not implement
automated deletion, but only creates the spec field and the
safety feature of halting orchestration other than deletion on a
cluster with a set cleanup policy value.
Partially-fixes: #3222
Signed-off-by: Elise Gafford <egafford@redhat.com>
It is not necessary to have 2 same environment variables and not desired as
changing only one may lead to the second variable being applied with unexpected
value. It is better to have only 1 ROOK_HOSTPATH_REQUIRES_PRIVILEGED environment
variable.
Closes: https://github.com/rook/rook/issues/5107
Signed-off-by: Adler Fleurant <Adler.Fleurant@PicoChange.com>
This commit adds all the CSI configurations to ConfigMap.
This configMap can be used in combination with Env Vars
to configure Ceph CSI drivers in rook.
Signed-off-by: Umanga Chapagain <chapagainumanga@gmail.com>
There are many namespace fields in ClusterRole{,Binding}. However,
ClusterRole{,Binding} are not namespaced. So we can remove these.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
The CRD watcher has been replaced by the new controller-runtime
framework.
This brings robustness in our operator, meaning that any resources that
are modified will be reconciled into the desired state.
Closes: https://github.com/rook/rook/issues/4937
Signed-off-by: Sébastien Han <seb@redhat.com>
The NooBaa operator was proposed for addition to Rook, but
the team went a different direction and created an independent
operator. Removing the stale docs.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cluster-minimal.yaml example is more confusing than helpful. Most users
seem to think that minimal includes a fully working cluster with OSDs.
The cluster-on-pvc.yaml example is frequently used and was missing from the
examples doc.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This is needed to allow the ceph manager rook module to read the output
of the <lsmcli> command used to switch disk identification light on/off on
physical disk devices
[test ceph]
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
Current YugabyteDB operator code creates Master and TServer pods without any resource requests/limits (specifically CPU and memory).
This causes the operator to run into soft/hard memory limit issue. The fix adds recommended resource requests and limits as defaults to the pods it creates.
Closes: https://github.com/yugabyte/yugabyte-db/issues/3884
Signed-off-by: Sameer Kulkarni <samkulkarni20@gmail.com>
The Ceph mgr modules need access to restart the daemon pods
when the configuration changes for the daemons.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The .metadata.generation field is updated if and only if the value at the .spec subpath changes.
Additionally, if the spec does not change, .metadata.generation is not updated.
This is a must-have for the controller-runtime work, if we don't have
this, the generation field will always be incremented, resulting in a
endless reconcile loop.
Signed-off-by: Sébastien Han <seb@redhat.com>
Checks the version of the configured ceph-csi image while starting the operator. The operator will fail if the image is not supported.
Added an additional parameter to operator to disable the check e.g. to test not yet supported csi images.
Signed-off-by: Stefan Haas <shaas@suse.com>
As of Octopus, Ceph will prevent you from creating a pool with a
replica size of 1. Allowing such pool could lead to data loss, so enable
the new option: requireSafeReplicaSize: false if you are **ABSOLUTELY**
certain that is what you want.
Closes: https://github.com/rook/rook/issues/4889
Signed-off-by: Sébastien Han <seb@redhat.com>
The ceph/ceph:v14.2.7 image is released so we can pick these fixes
up as the recommended version of ceph.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When the OSD on PVC is backed by a metadata block PVC, the Ceph CRUSH
device class should be set to something else rather than the rotational
property of the drive.
Closes: https://github.com/rook/rook/issues/4881
Signed-off-by: Sébastien Han <seb@redhat.com>
Creating an EC pool was succeeding, but then the update to the
status was failing because of an incorrect check for changing EC
parameters. Now we correctly check if EC parameters are changing
unexpectedly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
"rook-ceph-operator-config" can be used to override Env Var
initialized during operator deployment.
This commit makes use of the ConfigMap to determine NodeAffinity
and Tolerations for ceph-csi drivers.
Closes#3239
Signed-off-by: Umanga Chapagain <chapagainumanga@gmail.com>
We now support the addition of the PVC that acts as a metadata device
for a given OSD.
For this, you need to create a new `volumeClaimTemplates`, its name must
be "metadata" otherwise, Rook won't pick it up.
A template will look like this:
```
volumeClaimTemplates:
- metadata:
name: data
spec:
resources:
requests:
storage: 10Gi
# IMPORTANT: Change the storage class depending on your environment (e.g. local-storage, gp2)
storageClassName: gp2
volumeMode: Block
accessModes:
- ReadWriteOnce
- metadata:
name: metadata
spec:
resources:
requests:
storage: 6Gi
# IMPORTANT: Change the storage class depending on your environment (e.g. local-storage, gp2)
storageClassName: gp2
volumeMode: Block
accessModes:
- ReadWriteOnce
```
We now map block and block.db directly inside the container instead of
running ceph-volume activate. This is much cleaner.
Closes: https://github.com/rook/rook/issues/3852
Signed-off-by: Sébastien Han <seb@redhat.com>
The replication and erasure code settings are mutually exclusive
so must both be treated as optional by the schema validation.
The minimum must be set to 0 to treat them as optional.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
zoetrope
Suraj Deshmukh
Sébastien Han
Dmitry Yusupov
Dmitry Yusupov
Chu Yong Mark Lee
Rohan CJ
Satoru Takeuchi
Blaine Gardner
ShyamsundarR
Elise Gafford
Adler Fleurant
Umanga Chapagain
Juan Miguel Olmo Martínez
Sameer Kulkarni
Stefan Haas
Maksim Nabokikh