Wait for the mon-canary pods to be terminated before starting the actual
mons. When topology spread constraints are added to evenly spread the
mons, then pod-anti affinity does not allow mons to be created on the
same node where other mons are running, this also includes the
mon-canary pods. We delete the mon-canary pods and then start the actual
mon pods. Sometimes the termination of the canary pods might take more
time, so schedular won't schedular mon pods on that node.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 3137a857df)
The mon canary should quickly shut down after the pod is
deleted, since it has no purpose to continue running.
Since the sleep does not catch the SIGTERM as pid 1,
use a bash trap to exit quickly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 48b70500fa)
blocklisting IP can cause problems when the cleanup
job pod runs on the same host or gets the same ip
as that of the rbd client ip that is present in
the rbd status/watchers. instead of blocklisting
the whole ip of the node or the client blocklist
only the unique ip:nonce to allow the node to not
have any effect because of the cleanup job.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 5ae49cf7a0)
Signed-off-by: subhamkrai <srai@redhat.com>
Resolves this incorrect field description:
~ $ k explain cephobjectzone.spec.zoneGroup
GROUP: ceph.rook.io
KIND: CephObjectZone
VERSION: v1
FIELD: zoneGroup <string>
DESCRIPTION:
The display name for the ceph users
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8b58d68592)
Resolves this incorrect field description:
~ $ k explain cephobjectzonegroup.spec.realm
GROUP: ceph.rook.io
KIND: CephObjectZoneGroup
VERSION: v1
FIELD: realm <string>
DESCRIPTION:
The display name for the ceph users
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 1a1478a342)
When removeing CephBlockPool check first that related ceph pool is exist in cluster,
since it may be manually removed by mistake.
Related-Issue: #16328
Signed-off-by: Denis Egorenko <degorenko@mirantis.com>
(cherry picked from commit c9e0f89a8b)
Mount /run/udev inside cluster cleanup jobs and disable udev sync
with DM_DISABLE_UDEV.
Related-Issue: rook#16292
Signed-off-by: Denis Egorenko <degorenko@mirantis.com>
(cherry picked from commit 09622a8b8d)
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 182cd211ca)
delete csi-related directories from /var/lib/rook that
match the suffix `.csi.ceph.com`.
these folders were used in earlier versions when rook managed
cephcsi directly. in later versions, logs and data are redirected
to /var/lib/cephcsi, but legacy paths may still exist and require
cleanup during uninstall.
this change improves cleanup completeness for odf 4.18 and earlier.
example of directories removed:
- /var/lib/rook/openshift-storage.cephfs.csi.ceph.com
- /var/lib/rook/openshift-storage.rbd.csi.ceph.com
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 87165cc6d1)
This enables configuring the CrossNamespaceVolumeDataSource feature gate
Signed-off-by: CL0Pinette <me@cl0pinette.fr>
(cherry picked from commit b63c222d17)
The `CephBlockPool` CR allowed any algorithm to be specified in
`spec.erasureCoded.algorithm`, but in practice only `isa` or `jerasure`
would work.
Make that restriction explicit by restricting this field to `isa` or
`jerasure` in the CRD.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit 0b423a30f9)
When a `CephBlockPool` defines `spec.erasureCoded.algorithm`, use it as
the erasure-code-profile plugin.
Until now, that parameter would have been ignored completely, and every
erasure-coded pool would use the same plugin as the `default`
erasure-code-profile (i.e. `jerasure`).
Note that using any algorithm other than `jerasure` or `isa` is likely
to fail given the current implementation, as different algorithm require
different sets of parameters, and those cannot be supplied by the
user.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit d7f08693ed)
A typo was causing the operator to attempt to sync bucket policy when
the state was already in sync. This resulted in the operator carrying
out unnecessary work and logging activity with no user visible change
resulting.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit fbc60608ed)
Avoid the OSD startup failing to parse crush_location when
the topology label is empty.
Signed-off-by: chentao.2022 <chentao.2022@bytedance.com>
(cherry picked from commit 62631d2614)
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 79a7a3c01f)
add RecoverAndLogException() helper to log panics with stack trace.
added defer call in all rook controller Reconcile() methods for
better error visibility in operator logs
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit cf13deee6f)
This script includes bash features and will fail if sh is not a symlink to bash.
Signed-off-by: José Martínez <xose@google.com>
(cherry picked from commit e421623fd0)
fixes a nil pointer dereference in GetProbeWithDefaults when
startupProbe is set in cephfilesystem and currentProbe is nil.
adds panic recovery in cephfilesystem reconcile loop to improve
error visibility and avoid silent reconcile restarts.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 51e9ddc3f5)
Update all the go modules to the latest, except for the modules
that require go 1.24. Those modules will be updated in a
follow-up change.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 24b0b866ab)
If the node for an OSD does not exist within kubernetes, the PDB
reconciliation logic will fail to make progress. This can be problematic
as new OSDs added to the cluster may not be protected by OSD PDBs after
they are added since the PDB reconcilation logic is failing.
The solution is to treat non existing OSD nodes as drained which is
logically consistent with treating unschedulable OSD nodes as drained as
you cannot schedule a pod onto a node which does not exist.
Fixes: #16086
Signed-off-by: Elias Carter <elias@dropbox.com>
(cherry picked from commit 5f2d6c01d7)
When a mon is failed over, the old mon is left in mon quorum
until the new quorum is confirmed in quorum. When host networking
is enabled, this may result in two mons being in quorum with the
same ip, if the new mon is scheduled on the same node as the
down mon. This results in daemon crashes in the cluster since
they are confused by multiple of the same ip in the mon map.
The solution is to avoid scaling down the bad mon when host networking
is enabled. This will ensure the new mon is not scheduled on the
same node as the previous mon. With host networking, either another
node is necessary or the original mon must come back online to
restore quorum.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit aa61ddb57e)
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
(cherry picked from commit 27010f96f3)
currently, we're setting the env `DISCOVER_DAEMON_UDEV_BLACKLIST`
in operator.yaml but we're not reading from the operator env and
setting the value to discover pod env.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 2742a707cc)
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 7f3e6bd7fa)
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 5094b1f5e6)
If RemoveSecret is set remove the secret.
if not set, do below
check if the current cephClient is owner if
secret is present, if not return as its owned
by other controller, if its not present create
or update the secret.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d37297475e)
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d6d2e604fc)
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 8249a28145)
When force-deletion annotation is added to CephRadosNamespace CR, then
blocklist any watchers on the Namespace images in order to remove the
image from the trash
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 98475e847e)
The rados namespace status was not reporting if the namespace
was empty. Now the condition will be properly updated if
it is empty.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit b47f297608)
During the OSD preparation step, if the encrypted OSD disk belongs to a
different cluster, then clean the disk if `wipeDeviceFromOtherClusters`
is set to true.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 71bcdb533e)
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit dd65dc15d8)
change logger.info to logger.infof to correctly print
radosnamespace name and namespace
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 41d6baf0e1)
the status was still reading from the nil state,
updated the code to dont read from nil object
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 0b4f89873c)
parth-gr
Joshua Hoblitt
Travis Nielsen
Santosh Pillai
Madhu Rajanna
Denis Egorenko
Oded Viner
CL0Pinette
Benoît Knecht
chentao.2022
José Martínez
mergify[bot]
Artem Torubarov
Elias Carter
Vilius Puškunalis
subhamkrai
Patryk Rostkowski
raaizik
Muhammad Adil Ghaffar