the nvmeof gateway requires privileged containers with
sys_admin capability. the rook-ceph scc only allowed mknod,
causing pod creation to fail on openshift with:
"unable to validate against any security context constraint"
add sys_admin to allowedcapabilities in the helm chart sccs
and the go scc helper. this does not affect other daemons
(osd, rgw, mgr, mon) since they do not request sys_admin.
the operator-openshift.yaml example already includes
sys_admin, so this aligns the helm charts to match.
Signed-off-by: Oded Viner <oviner@redhat.com>
bump golang.org/x/net from v0.52.0 to latest patched version
to resolve known http2 vulnerability flagged by govulncheck.
the vulnerable call path is:
object.debugHTTPClient.Do
-> httputil.DumpRequestOut
-> http2.Transport.RoundTrip
this is a pre-existing issue blocking ci on all pull requests.
Signed-off-by: Oded Viner <oviner@redhat.com>
Added monRunAsRoot chart value to support the ROOK_CEPH_MON_RUN_AS_ROOT environment variable in the operator ConfigMap.
Fixes#17452
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
this commit add option in the ceph objecstore CR
to configure TLS profile and TLS ciphersuite for
rgw beast.
Signed-off-by: subhamkrai <srai@redhat.com>
Previously, shouldFailoverMonImmediately() was called only when a mon first went out of quorum. If the node gets deleted after the timeout starts, it does not get detected until the timeout expires. Moved the call outside the timeout initialization block so it runs on every health check iteration and detects node deletion immediately.
Fixes#15953
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
`make lint` runs all available linters and tskes quite some time
(around 25 to 35 seconds) to complete, eventually failing on lint.python,
at least locally on some machines.
This change splits a target `lint.quick` out of `lint`.
`make lint.quick` runs all linters except for `lint.python`
and consistently takes some 20 seconds
of runtime to complete successfully.
Signed-off-by: Michael Adam <obnox@samba.org>
The ROOK_RECONCILE_CONCURRENT_CLUSTERS feature was implemented
in v1.19. This feature has been stable, with no related issues
reported. The feature is tested in the CI with no known
stability issues. Let's declare this feature as stable.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cmd-reporter ResourceRequirements are used by the
`rook-ceph-detect-version` pod. Setting a default ResourceRequirement
is useful in and of itself while always allowing the `values.yaml` serve
double duty as a configuration example.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Recently, in PR #17445, a new naming taxonomy was introduced for the naming
of make targets, specifically linting targets.
This change aligns the `vet` target with that taxonomy by renaming it to
`lint.vet`.
Signed-off-by: Michael Adam <obnox@samba.org>
Going forward, admin will manage the csi operator
CR's and rook will only manage Ceph Connection cr
and client Profile cr.
The old csi driver is completely removed from Rook
and can no longer be used starting in Rook v1.20.
The upgrade guide will contain the needed transition steps
for managing the csi operator settings.
Signed-off-by: subhamkrai <srai@redhat.com>
The canary test was waiting for replicapool
instead of replicapool2, and a more reliable
wait for the toolbox pod start is added.
Signed-off-by: subhamkrai <srai@redhat.com>
The linting targets used to mostly have ad-hoc names usually reflecting
the linting tool used (like shellcheck, yamllint, and checkmake).
This change systematizes the names of the linting targets to follow a
pattern of lint.foo where foo usually reflects *what* is linted rather
than *how*.
so, more idiomatically, the pattern can be described as "action.thing"
to indicacte that "action" is to be performed on a "thing".
This systematization is achieved by renaming a couple of targets:
- shellcheck -> lint.shell
- yamllint -> lint.yaml
- checkmake -> lint.make
0 helm.lint -> lint.helm
- pylint -> lint.python
fmt -> lint.fmt
Additionally, a new target go.lint is introduced that runs
several go linting tools.
Finally, two fixing targets are renamed for consistency:
* fmt-fix -> fix.fmt
* markdownlint.fix -> fix/markdown
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
The upgrade integration tests for the v1.20 release need to
validate the upgrade starting from v1.19 to the latest.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Detect OSD encryption from the dmcrypt block path in `getOSDInfo` as a
fallback when the `encrypted` label is missing on pre-label deployments.
Include `osd.Encrypted` in the label check in `makeDeployment` so the
label reflects the actual OSD state on upgrade.
Fixes a bug where upgrading to a Rook version with the `encrypted` label
would set the label to `false` on already-encrypted OSDs, because the
label didn't exist yet and `getOSDInfo` defaulted to `false`.
Signed-off-by: Santosh <sapillai@redhat.com>
migrate bucket provisioner from aws sdk v1 to v2.
replace awserr.Error type assertions with smithy.APIError
using errors.As for v2-style error handling.
switch setBucketPolicy and setBucketLifecycle to use
the v2 s3 client (ClientV2) directly with context.
replace v1 s3 types (BucketLifecycleConfiguration,
GetBucketLifecycleConfigurationOutput) with v2 equivalents
from s3types and s3v2 packages.
add cmpopts.IgnoreUnexported to cmp.Diff calls to handle
unexported noSmithyDocumentSerde fields in v2 sdk types.
add nil guard on lifecycle output before accessing rules
to prevent nil dereference when get returns an error.
depends on #17414
Signed-off-by: Oded Viner <oviner@redhat.com>
With the default version now being v20.2.1, also update
all of the examples, documentation, and default CI to run
with that version
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
subham rai
Travis Nielsen
dependabot[bot]
Oded Viner
Blaine Gardner
Prabhala Tara Aasrita
Santosh Pillai
subhamkrai
Madhu Rajanna
Michael Adam
Joshua Hoblitt
Rohan Gupta