this commit update the csi-operator to latest v1.0.0.
we need to manually patch the csi drivers with the new serviceAccount
name that are being creating based on the latest ceph-csi-operator
release v1.0.0 where serviceAccount are being separate from csi-operator
chart.
co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
Update the description in the object-external example. Previously it
contained a note about replication recommendations, which does not apply
when using an external Ceph cluster object store.
Signed-off-by: Sting Alleman <me@stingalleman.nl>
net_raw is listed in the rook-ceph scc allowedcapabilities
but no daemon uses it — all pods explicitly drop net_raw.
remove it to align with the go scc helper and helm charts.
Signed-off-by: Oded Viner <oviner@redhat.com>
this commit adds flag stripe_unit for the command
ceph osd erasure-code-profile set [flags]. This key
increase perfomance for ec pool. The default value
is 4kib/4096 bytes.
Signed-off-by: subhamkrai <srai@redhat.com>
the nvmeof gateway requires privileged containers with
sys_admin capability. the rook-ceph scc only allowed mknod,
causing pod creation to fail on openshift with:
"unable to validate against any security context constraint"
add sys_admin to allowedcapabilities in the helm chart sccs
and the go scc helper. this does not affect other daemons
(osd, rgw, mgr, mon) since they do not request sys_admin.
the operator-openshift.yaml example already includes
sys_admin, so this aligns the helm charts to match.
Signed-off-by: Oded Viner <oviner@redhat.com>
Added monRunAsRoot chart value to support the ROOK_CEPH_MON_RUN_AS_ROOT environment variable in the operator ConfigMap.
Fixes#17452
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
this commit add option in the ceph objecstore CR
to configure TLS profile and TLS ciphersuite for
rgw beast.
Signed-off-by: subhamkrai <srai@redhat.com>
The ROOK_RECONCILE_CONCURRENT_CLUSTERS feature was implemented
in v1.19. This feature has been stable, with no related issues
reported. The feature is tested in the CI with no known
stability issues. Let's declare this feature as stable.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cmd-reporter ResourceRequirements are used by the
`rook-ceph-detect-version` pod. Setting a default ResourceRequirement
is useful in and of itself while always allowing the `values.yaml` serve
double duty as a configuration example.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Going forward, admin will manage the csi operator
CR's and rook will only manage Ceph Connection cr
and client Profile cr.
The old csi driver is completely removed from Rook
and can no longer be used starting in Rook v1.20.
The upgrade guide will contain the needed transition steps
for managing the csi operator settings.
Signed-off-by: subhamkrai <srai@redhat.com>
With the default version now being v20.2.1, also update
all of the examples, documentation, and default CI to run
with that version
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
the rook-ceph-nvmeof service account is not listed in the
securitycontextconstraints users, causing cephnvmeofgateway
pods to fail on openshift. add the service account to the
scc in the helm charts, go scc builder, and test namespace
substitution.
Signed-off-by: Oded Viner <oviner@redhat.com>
Clean up stale CRUSH rules after the Ceph mgr starts so rules left behind by pool failure-domain or device-class changes do not accumulate indefinitely.
The cleanup is guarded by a package-level RWMutex. Pool create and update paths hold the read lock while creating and assigning CRUSH rules, while cluster-wide cleanup holds the write lock before listing pools and deleting unused rules. This keeps pool reconciles parallel with each other while preventing cleanup from deleting a rule that another reconcile has just created but not yet attached to a pool.
Keep direct pool-delete cleanup for the pool's current CRUSH rule, make the cluster-wide cleanup best-effort across all unused rules, and add an operator-level ROOK_DELETE_UNUSED_CRUSH_RULES setting for clusters that need to leave unused custom rules in place.
Document the operator and Helm settings, regenerate the Helm chart docs, and add a pending release note for the default cleanup behavior.
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
This parameter is written to .spec.cephFS.radosNamespace of the generated
ClientProfile.
The parameter is called 'CSIMetadataRadosNamespace' to clarify that it is used
for CSI metadata and unrelated to the actual CephFS (meta)data.
Context:
The ceph-csi CephFS plugin stores additional metadata related to PV(C)s
in RADOS objects in the metadata pool of the CephFS.
By default those objects are stored in the 'csi' RADOS namespace.
For a multi-tenant CephFS setup (that is used by multiple K8s Clusters/
ceph-csi drivers) segregating those additional objects into separate RADOS
namespaces is desireable so the clusters can not modify the metadata of other
clusters (enforced by appropriate ceph client capabilities).
'ceph-csi' implemented this via the `cephFS.radosNamespace` config option for
cluster entries in the `ceph-csi-config` ConfigMap with https://github.com/ceph/ceph-csi/pull/4661.
The `ceph-csi-operator` added support for that config entry by adding
'radosNamespace' to the 'CephFsConfigSpec' of the 'ClientProfile' with
https://github.com/ceph/ceph-csi-operator/pull/165.
Signed-off-by: Alexander Degenhart <degenhart@fim.uni-passau.de>
Previously the unreachable node toleration on the operator pod was hardcoded to 5 seconds in the Helm chart and the ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS env var was notset up at all. This change reads both from .Values.unreachableNodeTolerationSeconds (defaulting to 5).
Fixes#17303
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Add a standalone Job manifest mirroring the cleanup logic the operator
executes via cleanUpJobTemplateSpec when a CephCluster is deleted with
cleanupPolicy enabled.
Useful when the operator-managed cleanup did not run (e.g. force-deleted
cluster) or a node needs manual cleanup outside normal operator flow.
Secrets (ROOK_MON_SECRET, ROOK_CLUSTER_FSID) are sourced from the
rook-ceph-mon secret via secretKeyRef. Namespace is injected via the
Downward API. Only dataDirHostPath and node hostname need manual input.
Closes#17255
Signed-off-by: Mateen Anjum <mateenali66@gmail.com>
for tnf, adding initial api changes and implementation for floating mon.
The current pr follow embeded yaml approach for creating floating mon
deploymen instead of configmap approach.
Signed-off-by: subhamkrai <srai@redhat.com>
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
With the release of the ceph csi operator v0.6.0,
update the helm chart dependency that was missed when
the csi-operator.yaml manifest was updated.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
There is no need to manually deploy Ceph-CSI/NVMe-oF anymore, the YAMLs
can be removed as the example operator.yaml includes the options now.
Signed-off-by: Niels de Vos <ndevos@ibm.com>
This PR creates the account root user by default when
CephObjectStoreAccount CR is created and skips it if
`spec.rootuser.skipCreate` is true.
Signed-off-by: Santosh <sapillai@redhat.com>
The helm chart will allow setting annotations and labels
in the CephCluster CR via the helm settings in values.yaml
named cephClusterMetadata.
Signed-off-by: Mathieu Parent <mathieu.parent@insee.fr>
Updated the following csi sidecars to their latest available versions:
- csi-attacher: v4.11.0
- csi-snapshotter: v8.5.0
- csi-resizer: v2.1.0
- csi-provisioner: v6.1.1
- csi-node-driver-registrar: v2.16.0
Signed-off-by: Praveen M <m.praveen@ibm.com>
Travis Nielsen
subhamkraiandTravis Nielsen
Joshua Hoblitt
Sting Alleman
Oded Viner
Prabhala Tara Aasrita
Joshua Hoblitt
Asish Kumar
Elias Carter
Alexander Degenhart
Santosh Pillai
Daniel Gonzalez
Mateen Anjum
Tarun Gupta Akirala
Blaine Gardner
majiayu000
Niels de Vos
Niraj Yadav
Artem Torubarov
Mathieu Parent
Praveen M