When there are two mgr daemons, a sidecar of the mgr will update the
service monitor depending on the active mgr daemon. When there is only
a single mgr, the operator will create the service monitor. Now, we
add rbac for the mgr to create these resources.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Implement the first step of `design/ceph/resource-dependencies.md` to
add dependency checking when deleting a CephCluster.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We have been having many issues with external mode with Ceph version
mismatching. The operator would have a Ceph version different than the
external cluster. The `radosgw-admin` was used to interact with S3
users, even a small version delta would cause the command to coredump.
After checking with the rgw core team it appears Rook was misusing the
CLI and the admin ops API should be used instead.
So this patch is the first introduction of go-ceph in Rook to consume
the rgw admin ops API instead of the `radosgw-admin` CLI, **only** for
user management in this initial commit.
Later we can do more such as bucket operation, zone management etc.
Closes: https://github.com/rook/rook/issues/7924
Signed-off-by: Sébastien Han <seb@redhat.com>
Currently it is not possible to set resource limits based on device classes
for different OSDs. Now adding an ability to use predefined keys for main
cluster spec Resource section to reflect resource limits for different OSDs
with different device classes.
Closes: https://github.com/rook/rook/issues/8007
Signed-off-by: Denis Egorenko <degorenko@mirantis.com>
Both MonSpec.Count and CephVersionSpec.Image should be optional for the
external cluster. So marking them as so.
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit adds support for adding tolerations and affinities for
cephfs and rbd (provisioner & nodeplugin) pods separately.
Closes: #7060
Signed-off-by: Rakshith R <rar@redhat.com>
earlier, to change the operator log level we need
to change the deployment which requires a restart
the operator pod.
Now, we are changing the log level dynamically
by reading the configmap. For, backward compatibility
we still load from env var.
Signed-off-by: subhamkrai <srai@redhat.com>
Ceph v16 will be the default in Rook v1.7. Update references in the
master branch from v15 (currently v15.2.11) to v16 (currently v16.2.4).
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
added volume replication operator release-v0.1
branch to the go.mod as we are doing enhancements to the
volume replicaiton CRDS. Once we have a release will
change this to release-v0.1 branch.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
corrected the component in mirroring yaml and added
appropriate mirroring related affinity example.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The ingress kind is found in apiversion networking.k8s.io/v1 since K8s
1.19. We now update the examples to use v1 instead of v1beta1.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
`CephObjectStore->gateway->type` is not used. Rook has only supported s3-like
interface and hasn't had no code which handles `type` field.
In addition, this field was removed from CRD in the following commit.
ceph: auto-gen crds
31db03fece
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Enabling rbac is a legacy setting from way back when the operator
was creating the rbac internally, instead of declaring it explicitly
in the common.yaml. There is no need for this setting now.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The preparation script does not require any manual inputs anymore. The
cluster/examples/kubernetes/ceph/create-external-cluster-resources.sh
will create and set the env variable needed for the import script.
Hopefully this will reduce the friction in some installation, especially
for the mon ports.
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit removes `# apiVersion: snapshot.storage.k8s.io/v1alpha1`
line in cephfs snapshotclass.yaml which was introduced in PR 7711 by mistake.
Signed-off-by: Rakshith R <rar@redhat.com>
In some clusters, the schema validation is failing for the default
object.yaml example that the value must be of a type string null.
While the null value shouldnt be strictly needed, we need working
examples by default.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The upgrade of the csv is failing to the latest schema when
the crushDeviceClass is specified and when the volumeClaimTemplate
annotations do not preserve the unknown fields. To fix the upgrade,
we preserve the fields even though it should not be necessary
from the strict schema.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Ceph v16.2.2 is released with dated tag v16.2.2-20210505. Update Ceph
images to match with or without date as appropriate.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This commit updates external-snapshotter version to
v4.0.0 which supports snapshots v1.
Rook now defaults to enabling RBD and CephFS snapshotter
for K8s >= v1.17 and disabling it for K8s <= v1.16.
Supporting changes in documents and examples yaml files
are made.
Signed-off-by: Rakshith R <rar@redhat.com>
The VolumeSource type was only used internally when loading
the storageClassDeviceSets. The volumeSource element is never
expected to be specified in the CephCluster CR, so it is now
removed from the schema. The VolumeSource type is renamed to
deviceSet for clarity.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Because of the recent CRD changes made, the mon count had a minimum of
1, making the configuration of the external cluster impossible. The
operator would fail to add the finalizer:
```
2021-04-29 16:57:38.429451 E | ceph-cluster-controller: failed to reconcile. failed to add finalizer: failed to add finalizer "cephcluster.ceph.rook.io" on "test-external": CephCluster.ceph.rook.io "test-external" is invalid: spec.mon.count: Invalid value: 0: spec.mon.count in body should be greater than or equal to 1
```
We now fixed the CRD as well as adding the CR status.
Signed-off-by: Sébastien Han <seb@redhat.com>
The schema in v1.6 is more strict and we are seeing errors in the csv
upgrades where nullable values are not allowed for the pool settings.
We now allow the nullable settings again to fix the upgrade scenario.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add `SecuritySpec` to specify kms details for rgw in `ObjectStoreSpec` than using existing
`SecuritySpec` used for `ClusterSpec`. The vault secret engines conflict with OSD and RGW
kms encrytpion
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Allow metadata on VolumeClaimTemplates in StorageClassDeviceSets to be
persisted. The latest changes to controller-gen allows us to embed
objectmeta for embedded types.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Add necessary changes in object-openshift.yaml, ceph-object-store-crd.md for service serving cert support for RGW
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Service serving certificates are intended to applications that require
encryption in openshift. These certificates are issued as TLS web server
certificates. Currently RGW supports TLS authentication with help of
certs passed as secrets, in this case we add following details as
`service.annotations` in the Objectstore Gateway Spec :
```
service:
annotations:
service.beta.openshift.io/serving-cert-secret-name: <name for
autogenerated secret>
```
More details about service serving cert can be found at :
https://docs.openshift.com/container-platform/4.6/security/certificates/service-serving-certificate.html
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The latest octopus release is v15.2.11 so we should use
it in the default examples to pick up the latest fixes.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
We have seen new cases where retrying to lock the device 3 times is not
enough. It's the same race we had experienced where Ceph tries to
acquire a lock on the device but systemd-udevd does the same too.
Retrying 20 times every 0.1sec seems to mitigate that issue in the CI.
Signed-off-by: Sébastien Han <seb@redhat.com>
As we have cephcsi v3.3.1 release
with couple of bug fixes and a CVE fix
updating the cephcsi to latest release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The device class can be any arbitrary value for a pool, depending
on the device class either automatically detected for the OSDs
or an arbitrary device class applied to OSDs in the cluster.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This is the first bugfix release in the Pacific stable series. It
addresses a security vulnerability in the Ceph authentication framework.
We recommend users to update to this release. For a detailed release
notes with links & changelog please refer to the official blog entry at
https://ceph.io/releases/v16-2-1-pacific-released.
Signed-off-by: Sébastien Han <seb@redhat.com>
Madhu Rajanna
Travis Nielsen
subhamkrai
Blaine Gardner
Sébastien Han
Arun Kumar Mohan
Denis Egorenko
rohan47
Rakshith R
Blaine Gardner
Satoru Takeuchi
Jiffin Tony Thottan
shenjiatong