This commit adds seccomp annotations to the PSP shipped with Rook
Operator. In this way the operator when deployed will be more secure and
will only be allowed the syscalls defined the runtime's seccomp profile.
Signed-off-by: Suraj Deshmukh <surajd.service@gmail.com>
Previously, the rbd-mirror daemon was integrated into the `CephCluster`
CRD. This wasn't really practical since we would have to wait for the
whole orchestration to be done to actually set it up. The same goes for
any CR update. Let's say you want to change the number of daemons, Rook
would go through mons, mgrs and osds until it get to rbd-mirror.
This triggers an undesired full orchestration.
With its own CRD this component just gains a lot more flexibility.
Closes: https://github.com/rook/rook/issues/5084
Signed-off-by: Sébastien Han <seb@redhat.com>
The command line flags parsing inside an init() method was causing
issues at runtime when trying to add certain new features, which
is a limitation of the flag parsing. We now move away from using
any command line flags in the tests and only use environment variables
to simplify adding new parameters to the tests.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Ceph integration test tries to wipe all lvms including
the ones that are not related to this test.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Update cephcsi driver to v2.0.1 to allow nodes with
Ceph persistent volumes to shutdown cleanly. This requires
an additional bind mount (/run/mount) in cephfsplugin
and rbdplugin templates.
Signed-off-by: Chu Yong Mark Lee <markleechuyong@gmail.com>
You can now use Rook along with Multus. Multus must be up and running
and the right ressources must exist such as NetworkAttachmentDefinition
CR.
The Cluster CR spec has new fields to work with multus:
network:
provider: multus (or 'host' for hostNetworking)
selectors:
public: NetworkAttachmentDefinition name
cluster: NetworkAttachmentDefinition name
If only a single NetworkAttachmentDefinition is provided Rook will use
both anyway for the Ceph traffic.
Please refer to the doc to learn more.
Closes: https://github.com/rook/rook/issues/4716
Signed-off-by: Sébastien Han <seb@redhat.com>
Some versions of k8s can optionally enable extensions after deprecation.
This could lead to rbac denials when trying to perform operations on deployments
Signed-off-by: Rohan CJ <rohantmp@gmail.com>
The CephManifests interface is intended for manifests that install the product (RBAC, CRDs, operator, etc). These cleanup methods are more about test code. The test code needs to behave the same whether it is a normal install or an upgrade. We don't need to version it differently for upgrades between the CephManifestsMaster and CephManifestsV1_1 implementations
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
In case of multiple clusters, we don't want to delete all the mon directories under the dataDirHostPath during cluster cleanup.
This PR deletes the mon directory only if the montior secret key matches.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
With the release of Octopus we need to run the integration tests
on Octopus in order to have validation as a supported platform.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In order to ensure proper clean up of all the rook-ceph data when the cluster is deleted, we need to clean up the dataDirHostPath (var/lib/rook)
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
In order to perform full automation of cephcluster deletion safely
and protect against catastrophic data loss, the end user must be
able to signify that they intend to irrecoverably delete the data
in their cluster. The cleanupPolicy field of the cluster spec is
intended to communicate this. This patch does not implement
automated deletion, but only creates the spec field and the
safety feature of halting orchestration other than deletion on a
cluster with a set cleanup policy value.
Partially-fixes: #3222
Signed-off-by: Elise Gafford <egafford@redhat.com>
The integration tests are failing to run when the disks
are not properly cleaned up and the bluestore label
is still found. Now we run sgdisk to more completely
zap the disk.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Run the tests on latest nautilus with the tag ceph/ceph:v14 so we
are constantly testing on the latest release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit fixes the argument for "ceph-volume inventory".
When a device "/dev/mapper/foo" is being checked for its availability,
the argument should not be "/dev/foo" nor "/dev/dm-1".
Signed-off-by: morimoto-cybozu <kenji_morimoto@cybozu.co.jp>
This commit adds all the CSI configurations to ConfigMap.
This configMap can be used in combination with Env Vars
to configure Ceph CSI drivers in rook.
Signed-off-by: Umanga Chapagain <chapagainumanga@gmail.com>
The CRD watcher has been replaced by the new controller-runtime
framework.
This brings robustness in our operator, meaning that any resources that
are modified will be reconciled into the desired state.
Closes: https://github.com/rook/rook/issues/4940
Signed-off-by: Sébastien Han <seb@redhat.com>
The helpers for executing a process have long required an actionName
param which is not being used. Now we remove the old param
while also cleaning up various other usages of the exec
package.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The methods and arguments to the exec methods are not all used anymore.
This cleans up the methods to only what is necessary to improve
the readability and maintainability.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The ceph commands are now only written to the log in debug mode.
For commands that change the system state we now ensure that
a useful log entry is written. If all the details of the ceph
commands are needed, debug logging should still be enabled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
There are many namespace fields in ClusterRole{,Binding}. However,
ClusterRole{,Binding} are not namespaced. So we can remove these.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
The pool cleanup only needs to happen for an individual pool.
No need to query the block images in all pools. One of the rgw
pools is periodically causing a hang when it is queried,
but there is no need to query for it when we are cleaning
up the pool tests.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CRD watcher has been replaced by the new controller-runtime
framework.
This brings robustness in our operator, meaning that any resources that
are modified will be reconciled into the desired state.
Closes: https://github.com/rook/rook/issues/4937
Signed-off-by: Sébastien Han <seb@redhat.com>
This is needed to allow the ceph manager rook module to read the output
of the <lsmcli> command used to switch disk identification light on/off on
physical disk devices
[test ceph]
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
Current YugabyteDB operator code creates Master and TServer pods without any resource requests/limits (specifically CPU and memory).
This causes the operator to run into soft/hard memory limit issue. The fix adds recommended resource requests and limits as defaults to the pods it creates.
Closes: https://github.com/yugabyte/yugabyte-db/issues/3884
Signed-off-by: Sameer Kulkarni <samkulkarni20@gmail.com>
The Ceph mgr modules need access to restart the daemon pods
when the configuration changes for the daemons.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The integration tests for yugabyte were pointing to an image
outside of the rook repo. Since that image changed unexpectedly
it broke the rook integration tests. The tests need to use
the image built by rook.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The operator logs are necessary for troubleshooting why the
pools may still exist at the end of the integration tests.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The .metadata.generation field is updated if and only if the value at the .spec subpath changes.
Additionally, if the spec does not change, .metadata.generation is not updated.
This is a must-have for the controller-runtime work, if we don't have
this, the generation field will always be incremented, resulting in a
endless reconcile loop.
Signed-off-by: Sébastien Han <seb@redhat.com>
The CI is failing currently in the OSD-on-pv scenario due to a change
in v14.2.8. Until that is resolved, we need to unblock the tests
by running against v14.2.7.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
zoetrope
Suraj Deshmukh
Sébastien Han
Satoru Takeuchi
Chu Yong Mark Lee
Rohan CJ
Santosh Pillai
ShyamsundarR
Elise Gafford
morimoto-cybozu
Umanga Chapagain
Juan Miguel Olmo Martínez
Sameer Kulkarni