currently k8s add the default eviction time as 300 sec
setting it to 5 sec for the quick re-schedule
Signed-off-by: parth-gr <partharora1010@gmail.com>
When the OSD activate init container cannot match its configured
device, it falls back to a bare 'ceph-volume raw list', which
enumerates every block device on the node and opens each one to read
bluestore labels. Opening a krbd device whose backing cluster is
unhealthy can block in uninterruptible sleep; when that device's I/O
depends on the OSD being activated, activation deadlocks.
Build the fallback scan list explicitly with lsblk and exclude the
network-backed device types that can hang when their backing storage
is unavailable (rbd, nbd, drbd) along with zram (volatile RAM). Rook
never provisions OSDs on any of these, so the fallback can never
legitimately need to find an OSD on them. loop devices are kept,
since OSDs on loop devices are supported for CI and local testing.
Fail fast if the filtered list is empty rather than degenerating back
to a full scan.
Note this hardens only the rename-fallback path. The deadlock observed
in CI (kernel hung tasks under 'ceph-volume raw activate' opening a
stalled /dev/rbd0; actions runs 27325963851, 27333888237, and
27378983111, which reproduced it on this PR's own head) ultimately
originates inside ceph-volume: 'raw activate' runs an unconditional
LUKS2/TPM2 discovery sweep over all block devices even when given an
explicit --device. That requires a ceph-volume fix; this change makes
the Rook-controlled scan safe regardless of ceph version.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
AddCephVersionLabelToDaemonSet had no callers anywhere in the repo
(verified with deadcode and repo-wide grep); rook applies ceph version
labels to Deployments, Jobs, and object metas, but never to DaemonSets.
The shared addCephVersionLabel helper remains in use by the live
siblings.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
NFSDriverName was assigned once in the CSI controller reconcile but never
read anywhere in the repo (verified with repo-wide grep and an
exported-symbol audit). Remove the variable, its assignment, and the
nfsDriverSuffix const that only existed to feed it.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The OSDPerfStats struct had no references anywhere in the repo (verified
with repo-wide grep and an exported-symbol audit); the code that consumed
this unmarshal target was removed long ago.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
NewSharedStorageAndWorkerNodesValidationTestConfig was a wrapper that
simply returned NewDefaultValidationTestConfig() and had no callers
anywhere in the repo (verified with deadcode and repo-wide grep, tests
included). The sibling constructors are all referenced by the multus
validation CLI and remain.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
WriteFile and PathToProjectRoot had no callers anywhere in the repo
(verified with deadcode, staticcheck U1000, and repo-wide grep, tests
included). WriteFile has long been superseded by direct os.WriteFile
usage. Drop the now-unused bytes, fmt, and runtime imports; the file's
remaining helpers (WriteFileToLog, CreateTempFile) are still in use.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Make the NVMe-oF gateway image optional in the CR spec.
When not specified, the operator fetches the image from
the Ceph mon config store using the key
mgr/cephadm/container_image_nvmeof. Falls back to the
hardcoded default if the config is unavailable.
Signed-off-by: Oded Viner <oviner@redhat.com>
The realm system user's access and secret keys are generated by
GeneratePassword() and then wrapped in base64. GeneratePassword()
deliberately excludes '/' from the access key character set, but the
base64.StdEncoding wrap reintroduces it: its alphabet contains '/' and
'+', and the 14-character input always produces trailing '='. The
encoded string is the literal key used in S3 requests.
An access key containing '/' breaks AWS SigV4 credential scope parsing
("<access-key>/<date>/<region>/<service>/aws4_request" is split on
'/'), so "radosgw-admin realm pull" against the realm endpoint fails
permanently with "request failed: (22) Invalid argument" (HTTP 400),
and a CephObjectRealm pulling that realm can never reconcile.
This is the dominant cause of the "deploy second cluster rook"
failures in the rgw-multisite-testing canary job: every sampled failure
had a generated access key containing '/' and looped on EINVAL for the
whole 600s wait window, while runs with slash-free keys pulled the
realm successfully.
Encode both keys with base64.RawURLEncoding instead, whose alphabet
(A-Za-z0-9-_, unpadded) is safe in credential scopes, URLs, and shell
arguments. Only newly created realm secrets are affected; existing
secrets are not modified by the reconciler.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
When RGW and MDS intances are reduce to 1, the older RGW and MDS PDB
instance (with maxUnavailabe=1) are still available. This blocks node
drain when the node, on which the single RGW and MDS instances are
running, is drained.
This PR deletes any stale MDS and RGW PDB when the only 1 MDS and 1 RGW
instances are available.
Signed-off-by: Santosh <sapillai@redhat.com>
Remove four dead functions from pkg/daemon/ceph/client; none had any
callers anywhere in the repo (verified with deadcode, staticcheck U1000,
and repo-wide grep, tests included):
- auth.go: AuthGetOrCreate
- command.go: ExecuteRBDCommandWithTimeout
- filesystem.go: MarkFilesystemAsDown
- status.go: IsClusterCleanError (IsClusterClean itself remains in use)
No imports become unused by these removals.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Remove dead code from the k8sutil package; none of these symbols had any
callers anywhere in the repo (verified with deadcode, staticcheck U1000,
and repo-wide grep, tests included):
- patcher.go: delete file (Patcher type, NewPatcher, Patch)
- replicaset.go: delete file (DeleteReplicaSet)
- customresource.go: WatchCR (the CustomResource type remains in use)
- deployment.go: WaitForDeploymentImage
- job.go: WaitForJobCompletion
- k8sutil.go: GetK8SVersion
- pod.go: ConfigOverrideMount, ConfigOverrideVolume, GetPodLog
- prometheus.go: DeleteServiceMonitor
- service.go: DeleteService
- volume.go: NodeConfigURI, BinariesMountInfo, YamlToVolumes,
YamlToVolumeMounts, and the BinariesMountPath const (only used by the
removed BinariesMountInfo)
Now-unused imports are dropped from each file. The shared
deleteResourceAndWait helper remains (still used by DeleteDeployment).
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The Clear method on updateQueue had no callers anywhere in the repo
(verified with grep, deadcode, and staticcheck). The queue is emptied via
Remove/Pop in practice. Remove the dead method.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
kmod.go was entirely dead: IsBuiltinKernelModule, LoadKernelModule,
CheckKernelModuleParam, and the getKernelVersion helper had no callers
anywhere in the repo (verified with grep, deadcode, and staticcheck).
Remove the file.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
daemonset.go was entirely dead: CreateDaemonSet, DeleteDaemonset,
AddRookVersionLabelToDaemonSet, and GetDaemonsets had no callers anywhere
in the repo (verified with grep, deadcode, and staticcheck). Rook does not
manage any DaemonSets via these helpers. Remove the file.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Add support for the osd.rook.io/device-class node label to assign
CRUSH device classes to all OSDs on a node.
The operator reads the label during OSD provisioning and
deployment reconciliation. If CR-level deviceClass conflicts
with the node label, the operator will skip reconciling the
node and logs an error.
Resolves: #17131
Signed-off-by: Yuxiang He <yuxiang@dropbox.com>
The ReconcileCanaries field of controllerconfig.Context was set once in
cr_manager.go but never read anywhere, so the LockingBool type backing it
and its Get/Update methods were dead code (verified with grep and
staticcheck). Remove the field, the type, its methods, the initializer,
and the now-unused sync import.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
VerifyPodLabels had no callers anywhere in the repo, and it was the only
caller of VerifyAppLabels, which in turn was the only caller of the
checkLabel and combineErrors helpers. Remove the whole dead cluster (and
the now-unused strings, github.com/pkg/errors, and ceph/controller
imports). AssertLabelsContainCephRequirements in the same file remains and
is unaffected. Verified with grep, deadcode, and staticcheck.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
container.go in the ceph operator test-helper package was entirely dead:
ContainerTestDefinition, its TestContainer method, and the logCommandWithArgs
helper had no references anywhere in the repo (no test or non-test callers,
verified with grep, deadcode, and staticcheck). The package doc comment is
also present on info.go, so removing this file leaves the package documented.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
IsModuleInSpec has no callers anywhere in the repository (verified with
deadcode and grep). Remove the dead code.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
applyUpgradeOSDFunctionality() may run before all OSDs have registered
their new version, leaving require-osd-release unset and the cluster in
HEALTH_WARN.
Check for a single converged OSD version on each health-monitor tick and
set require-osd-release when it changes. The release name is cached to
avoid redundant ceph commands
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
Remove the following unreferenced symbols:
- (*S3Agent).CreateBucketNoInfoLogging
- (*S3Agent).DeleteBucket (wrapper; callers use the SDK client directly)
- GetBucketsStats
- ObjectBuckets type and its Len/Less/Swap sort.Interface methods
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Remove (*BucketPolicy).EjectPrincipals and (*PolicyStatement).EjectPrincipals,
which had no callers outside policy.go. Also drop the duplicate PutBucketVersioning
entry in AllowedActions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
ModifyBucketPolicy merged the caller's statement into the policy fetched
from the bucket, matching by SID. Besides a missing match flag that
appended a duplicate when a SID matched, this preserved any pre-existing
statements on the bucket and reapplied them on every reconcile.
Overwrite the policy with the provided statements instead, so a managed
bucket always ends up with exactly the intended policy and cannot retain
unexpected statements.
Signed-off-by: Artem Muterko <artem@sopho.tech>
when using encryptedDevice:true with host based (non pvc) osds, resizing
the underlying disk and restarting the OSD didn't expand the OSD because
the LUKS encryption layer was not resized.
This PR adds resize capabilities inside the activate container. Full
device stack must be resized: PV → LV → LUKS
Steps:
1. Run pvresize and lvextend to grow the LVM layers.
2. Retrieve the LUKS key from the Ceph config-key store using the
lockbox crednetials already available in the activate container
3. Pass the key explicitly to cryptsetup resize via --key-file.
Signed-off-by: Santosh <sapillai@redhat.com>
Travis Nielsen
Parth Arora
dependabot[bot]
Satoru Takeuchi
Joshua Hoblitt
subhamkrai
Santosh Pillai
Joshua Hoblitt
Blaine Gardner
Oded Viner
subham rai
Yuxiang He
Sunnatillo
Artem Muterko
