ClusterID uniquely identifies a cluster. It is used as a prefix to
nslookup exported services.
For example: <clusterid>.<svc>.<ns>.svc.clusterset.local
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit aefe0054c4)
The defaults in CRDs cause an update and trigger a new
reconcile if the value is not set. For the key rotation
setting, the default was only being updated when the kms
feature was enabled. This update was causing the reconcile
to fail in the kms tests. With the default now in code,
the default can remain empty and no cr update will trigger
a new reconcile unexpectedly.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit cd94ed7ddc)
The rgw dashboard can be disabled by the setting in the
CephObjectStore `gateway.dashboardEnabled` if set to false.
Signed-off-by: xiaobaowen <xiaobaowen@deeproute.ai>
(cherry picked from commit 253d4123f6)
Add a hostNetwork option for a Ganesha server.
This allows you to use host networking for the cluster but still
use regular pod networking for NFS Ganesha servers
Signed-off-by: Richard Bateman <taxilian@gmail.com>
(cherry picked from commit 0ca9da23e8)
This commit adds KeyRotationSpec to cephcluster CR
to support encryption key rotation feature.
If enabled Rook will create a cronjob for each
encrypted PVC based OSD with given schedule set
to rotate their respective key encryption key.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 46dd2eb5ff)
Enabling msgr v2 and disabling msgr v1 currently requires enabling
either encryption on the wire or compression on the wire.
As more clients are running on the latest kernel, allow
the clients to run on v2 even when encryption and compression
are not enabled. Clusters that are fully running on v2
will more easily be able to change configuration between
enabling or disabling msgr v2 features.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Based on the latest info from the Ceph RGW team, update all probes. Get
rid of the liveness probe entirely. Update startup and readiness probes
to support return codes for misconfiguration (500) and for server-side
throttling (498 or 503).
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The machine disruption budgets for handling openshift
machines and machinesets are now removed since they
have been unused and unmaintained since implemented.
This feature is expected to be handled with the more
common Pod Disruption Budgets. A workaround is for the
cluster admin to set up their machine sets so they
match the zone topology. See the original design
doc from the feature here:
https://github.com/rook/rook/blob/master/design/ceph/ceph-openshift-fencing-mitigation.md
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For the upgrade case, Rook can fail to set status information
on CephObjectStores after CRDs are updated but before the operator is
updated. To fix this, merely allow the slices to be null in the
CephObjectStore's status.endpoints.
This PR seems to be aggravating the helm filesystem upgrade test. Allow
30 more seconds for CRDs to be done before bailing. In debugging, the
filesystem often needed only an extra 3 seconds to succeed.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
External CephObjectStores already have endpoints defined by
spec.gateway.externalRgwEndpoints, and if the external store is
configured with TLS (HTTPS), the store's certificates will likely not
accept connections intended for the Service endpoint Rook creates. Some
users might not be able to easily add the service endpoint to their
certificates. Therefore, don't even bother creating a Service for
external clusters.
This does introduce a few issues. The Service seems to have been
initially created to allow multiple external RGW endpoints to be
addressable via a single address in Rook. For all connections to an
external CephObjectStore with multiple endpoints, simply choose an
endpoint at random. Random selection will prevent Rook from failing to
create buckets or users on an external store if one of the external
store's endpoints fails.
The latest OBC library (lib-bucket-provisioner) allows updating the
endpoints on ObjectBuckets after they are created. This allows Rook
users to change endpoints on external CephObjectStores without breaking
all existing OBCs. It requires implementation of the new GetUserID()
library call, requires updating Provision() and Grant() calls to be
idempotent, and it requires removing the Update() call.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The security scan is failing due to a go dependency
so we update the go modules and all dependencies to
the latest available.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Remove the health checker for CephObjectStore. The liveness and
readiness probes go through the same code paths in RGW as creating
buckets without as much affect on the storage backend.
Full discussion: https://github.com/rook/rook/issues/11031
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Introduce a new env variable ROOK_CSI_IMAGE_PULL_POLICY in rook operator configmap which should be used to
customize the imagePullPolicy for the csi driver and imagePullPolicy property in cephVersionSpec for ceph pods.
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
The sssd.conf may refer to additional files, like a CA bundle or TLS
certificates. These files need to be made available in the SSSD sidecar.
With the new `sssdGenericFiles` reference to a VolumeSource and a
`MountPath`, a provided `sssd.conf` can use the additional files.
Signed-off-by: Niels de Vos <ndevos@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
User can define his desired endpoint list in Zone CR so that it will
overwrite the default service name for rgw.
Resolves#6432
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
Implement the SSSD sidecar design for NFS.
Because NFS documents are getting long, create an NFS
`Storage-Configuration` section with separated topics to keep the `NFS
Overview` document sane.
Adjust the SSSD design to allow any VolumeSource, not just ConfigMaps.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The dependencies in controller runtim v0.5 were getting old
and causing go module issues on macos. Now with the update to
v0.6.2 the module dependency issue is solved. For another
day we should update the controller runtime to even newer.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The RGW support server side encryption with help of s3 protocol, till
now the `sse:kms` was support in which keys will be provided by the user
and but it will be saved in external management service like vault. Now
the support for `sse:s3` is added so the entire encryption key
management is performed by RGW itsels.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
this commits add new field `MaxLogSize` inside `LogCollectorSpec` of
cephCluster cr which will take max size of log after which we want to
rotate the log.
Signed-off-by: subhamkrai <srai@redhat.com>
The endpoint on the rgw realm pull spec is causing a failure
if not specified even when it is not expected to be
required. Now the endpoint has the json property to be
ommitted if not specified.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The prometheus rules had been previously created if the cephcluster CR
setting monitoring.enabled was set to true. The rules were not customizable
and therefore not flexible enough. Now the rules are installed by the helm
chart. To customize the rules, a post-processor can be applied to the helm
chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
this commit adding `Phase` in `additionalPrinterColumns` for
all the CRs.
this is how it looks now, example:
```
$ kc get cephfilesystem
NAME ACTIVEMDS AGE PHASE
myfs 1 4m57s Ready
srai@ ~
$ kc get cephblockpool
NAME PHASE
device-health-metrics Ready
replicapool Progressing
srai@ ~
$ kc get cephclient
NAME PHASE
cinder Ready
glance Ready
```
Closes: https://github.com/rook/rook/issues/9883
Signed-off-by: subhamkrai <srai@redhat.com>
In Quincy, the device_health_metrics pool is renamed to .mgr.
In the example cluster-test.yaml, we therefore update the
example to create the pool with the new name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
adding observedGeneration field in the cephcluster cr
status for having better control on reconciling,
as observedGeneration field will be updated by the controller
Closes: https://github.com/rook/rook/issues/9673
Signed-off-by: parth-gr <paarora@redhat.com>
msgr2 allows for encryption and/or compression across the wire.
Settings for enabling the encryption and compression are now
available in the cluster CR to that ceph will be automatically
configured with these settings when desired.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
sp98
xiaobaowen
travisn
root
Richard Bateman
Rakshith R
parth-gr
Blaine Gardner
Khris Richardson
Avan Thakkar
Niels de Vos
Jiffin Tony Thottan
zhucan
subhamkrai
Madhu Rajanna
Sébastien Han
Yuval Lifshitz