updating the csi-snapshotter and dependencies
to v5.0.1 released version.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This patch brings a mechanism to define arbitrary environment
variables in OSD containers (both prepare and main ones).
It bases on idea proposed by Sebastien Han to use an optional
`ConfigMap` instance named `aook-ceph-daemon-env-override`
as the source of these settings.
The need for the patch comes from the fact that, although
crimson finally exposes the same CLI interface as the classical
OSD, the broadly used development builds have ASan built in.
As ASan, by default, complains if it isn't the very first loaded
DSO, we need a way to set the `ASAN_OPTIONS` environment variable
to `verify_asan_link_order=0` to mitigate the early aborts.
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
Recent versions of helm are failing the linter on the end tag
if the tag is "{{- end -}}". Instead, the correct end tag
is "{{- end }}".
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit updates the csi-addons image version
from v0.1.0 to v0.2.1.
Also, this updates the staging path from
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/pv/ to
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/.
This changes is done as the reclaimspace on block mode
was not working.
For more details:
https://github.com/csi-addons/kubernetes-csi-addons/pull/97
Signed-off-by: yati1998 <ypadia@redhat.com>
Some operator settings can be applied dynamically in a configmap
instead of requiring the operator to restart. While these settings
may be infrequently updated, applying these settings in the configmap
can avoid an unnecessary operator restart. This will also make the
operator deployment more consistent with the non-helm install.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit restrict csiaddons to open only 1 port
as per the requirement which is required for security.
Fixes: #9604
Signed-off-by: yati1998 <ypadia@redhat.com>
add annotations to secrets and configmaps to use
different tools to sync secrets and configmap.
Currently, these annotation is applied only on
the `rook-ceph-mon-endpoints` configmap and
the secrets `rook-ceph-mon` and `rook-ceph-admin-keyring`.
Closes: https://github.com/rook/rook/issues/8999
Signed-off-by: subhamkrai <srai@redhat.com>
Even though mention about keda 2.x version, the scaledObject.yaml or
rgw-keda.yaml referring to older keda CRs
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The CSI users created by the external script(both for rbd and cephfs)
need the blocklist capability so the CSI pods can execute the
`osd blocklist` commands for metro DR
update the mon caps of csi users with `profile simple-rados-client-with-blocklist`
so they have privileges to run osd blocklist cmds
Closes: https://issues.redhat.com/browse/RHSTOR-2451
Signed-off-by: parth-gr <paarora@redhat.com>
Below sidecars are updated to the latest releases with this commit.
csi-provisioner : 3.1.0
csi-attacher : 3.4.0
node-driver-registrar: 2.4.0
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
right now the RoleBinding for monitoring is created with the cluster namespace as the subject
this causes the operator to loop on reconcile due to it not having permissions to create monitors
in the other cluster
moving the subject to the operator namespace fixes this
Signed-off-by: Henry Zhang <me@henry.dev>
Rook needs to be able to watch all `ceph.rook.io` resources to reconcile
them; however, it does not need blanket verb privileges. Reduce the
privileges as much as possible.
Ideally, Rook would only have update permissions to status and
finalizers of resources; however, finalizers are not a full-fledged
subresource at this time, and "update" permissions must be maintained
for `ceph.rook.io` resources.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
Recently with the directory renaming to "deploy/olm" the CSV name
changed from "ceph" to "olm". Now we are using the same "rook-ceph" name
regardless of the platform.
Signed-off-by: Sébastien Han <seb@redhat.com>
Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
The label was on the job, but not on the pod template,
so querying for the pod logs was not working as simply
as if we added the label.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job
creating pods under PSP-enabled Kubernetes cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
An older version of the Helm chart always installed RBAC permissions for
enabling monitoring. In an effort to reduce the privileges Rook uses by
default, they were removed. We need to still include the monitoring RBAC
optionally since the change could break some users.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Co-authored-by: Blaine Gardner <blaine.gardner@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
parth-gr
Travis Nielsen
Madhu RajannaandMathieu Parent
Radoslaw Zarzynski
yati1998
Blaine Gardner
Satoru Takeuchi
subhamkrai
Sébastien Han
Jiffin Tony Thottan
Humble Chirammal
Yuval Lifshitz
Henry Zhang
Daniel Ruiz Capilla
Yuichiro Ueno
Denis Egorenko