The AI guidelines said that listing AI tooling in a commit with a
`co-authored-by`, `assisted-by`, or `generated-by` trailer was not necessary,
which read as discouragement and left contributors unsure whether such a trailer
was welcome at all. The maintainers have since agreed that these trailers are
fine, so say so.
What the guidelines require is unchanged: sign-off is the human contributor's,
and AI assistance is disclosed in the pull request description.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 44fec7aeff)
Ask contributors without write access to keep no more than three pull requests
open at the same time, so that maintainer review — the project's limiting
resource — is not spread too thin, enforced through the repository's pull
request limit. Contributors with write access, who are actively engaged with
the project, are not restricted; anyone with a genuine need to exceed the limit
can raise it with a maintainer.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 83b2c2e488)
`AGENTS.md` is almost entirely links into `Documentation/`, which is what keeps
it from duplicating the documentation and drifting away from it. That only works
while the links resolve, and nothing checked them: the link checker walks
`Documentation/` alone, so a moved page would leave `AGENTS.md` pointing at
nothing and silently misdirect its reader.
Include it in the files the link checker walks.
The other markdown files in the repository root are left out on purpose. Several
of them already contain dead external links, and adding them here would fail the
nightly job for reasons unrelated to this change.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 9277239590)
# Conflicts:
# tests/scripts/check-markdown-links-internal.sh
AI coding agents read a top-level `AGENTS.md` by convention, and Rook has no
file at that path, so an agent entering this repository starts with no knowledge
of its conventions. The result is predictable: unsigned commits, invalid commit
prefixes, `pkg/apis` changes with no regenerated CRDs, AI attribution trailers
that the AI guidelines ask contributors not to use, and pull request checklists
with every box ticked.
Add an `AGENTS.md` that maps the reader onto the contributor documentation
instead of restating it, so that the two cannot come to disagree. What little it
states inline is the policy that holds no matter what else the reader skips,
such as signing off and disclosing AI assistance. Everything mechanical, and
therefore liable to change, is a link.
It also points at the pull request template, which GitHub supplies to anyone
opening a pull request in a browser but not to a tool that submits a body
directly, and which such a tool therefore has to be told to go and read.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 7ea0ce663f)
The integration tests mix testify's `assert` and `require`, and the choice
between them is not arbitrary: `require` fails fast so that later code does not
run against a nil or zero value, while `assert` lets a run report every property
that is wrong instead of only the first.
Write down the convention, along with the rule that neither belongs inside a
poll closure, where an assertion defeats the retry and `require` is not safe on
testify's `Eventually` goroutine.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit dd8f63e6e7)
Three of the checklist items say "if necessary" without saying what would make
them necessary, and a box ticked without a matching change misleads the reviewer
who reads the checklist as a claim about the diff. The deciding criterion in
each case is simply which folder the change touches.
State that folder next to each item, so the test is visible where the box is
ticked and needs no judgement to apply.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit d900c61b84)
The development flow guide described running unit tests and `make lint`, but
several other checks also gate every pull request and were documented nowhere:
`make golangci-lint`, `make codegen`, `make crds`, and commitlint. A contributor
had no way to learn about them short of pushing and reading a red CI run.
Add a table of the gating checks and the command that runs each one locally,
and document the parts that are easy to get wrong:
- Any change under `pkg/apis` requires regenerating the client, deepcopy
functions, CRD manifests, and CRD reference docs, and the regenerated files
belong in the same commit. This includes editing a godoc comment, since those
comments are copied verbatim into the CRD description fields.
- Commitlint infers a trailer from the shape of a line, so a body line that
begins with a word followed by a colon is read as one, and the commit is
rejected with `footer-leading-blank`.
- The commit prefix must come from the type list in `.commitlintrc.json`.
Also note that `make test` only covers `cmd/` and `pkg/`, so test files under
`tests/framework/` are compiled but never run by the unit test CI.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit e32ea6cbab)
Rook enforces Conventional Commits with commitlint in CI, but the only way to
check a message before pushing was a long `npx` invocation buried in the
developer guide. A make target is easier to remember and to reach for, both for
contributors and for tools.
`make lint.commits` runs the same commitlint over the commits on the current
branch. It compares against `origin/master`, rather than a local `master` that
is easy to leave stale and would drag already-merged upstream commits into the
range; override with `COMMITLINT_BASE` when the upstream is a different remote.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 800e88ef20)
# Conflicts:
# Makefile
The prepare job runs "ceph-volume raw prepare" per device and then trusts
a no-argument "ceph-volume raw list" to report the OSDs it just created.
That listing can come back without a freshly prepared device. On Ceph
v20.2.0 and v20.2.1, get_devices() enumerates through udev data under
/run/udev/data and returns nothing when that data is empty or not yet
populated (https://tracker.ceph.com/issues/77968). On every released
v20.2.x, a block device smaller than 4KiB in the scan, such as the 1KiB
extended-partition node of an MBR-partitioned OS disk, crashes the
batched ceph-bluestore-tool call behind the listing, which ceph-volume
reports as an empty result (https://tracker.ceph.com/issues/76354).
Either way the no-argument list comes back empty or incomplete even
though the OSD exists. Rook then silently reported fewer OSDs than it
prepared, the operator never created the missing OSD deployment, and the
cluster was left with OSDs in the osdmap but no daemons running.
Verify that every device prepared in raw mode is present in the listing.
For any that is missing, list it by name ("ceph-volume raw list
<device>"), which is immune to both failure modes and reports the OSD.
If even the per-device listing is empty, return an error so the prepare
job exits non-zero and Kubernetes restarts it with a freshly re-scanned
environment, rather than silently under-reporting the OSDs.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 09ce9e26cc)
Nothing verified that the commit being tagged for a release actually
carries the intended version. Tagging a release branch before the version
update PR is merged publishes images and manifests that reference the
previous release. Add build/release/validate-tag.sh to check that the tree
is clean and that deploy/examples/images.txt and the helm chart values
match the tag, run it from the release build workflow before any artifact
is published, and document it in the tagging steps. Alpha tags are exempt
as they only mark the creation of a release branch.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit adda6b17d3)
# Conflicts:
# .github/workflows/push-build.yaml
Publishing docs runs mike deploy against the rook.github.io gh-pages
branch. When two builds run close together, the branch can advance
between one build's fetch and its push, and the push is rejected as
non-fast-forward, failing the whole push-image-to-container-registry
job even though the images were already published (most recently on the
2026-07-06 master push burst). Reset the local gh-pages branch to the
remote tip and retry the deploy up to three times, so a lost race
redeploys onto the new tip instead of failing the build.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8b2bedfa9a)
The operator image in the rook-ceph chart and the Ceph image in the
rook-ceph-cluster chart are both configured as a repository and tag
pair. The toolbox was the exception, taking a single toolbox.image
string.
Add toolbox.repository and toolbox.tag, so the toolbox image can be
configured the same way as the others. Either setting may be applied on
its own; whichever is left unset falls back to cephImage.repository or
cephImage.tag.
The new settings take precedence over toolbox.image, which continues to
apply when neither is set, so existing values files are unaffected.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit faf2bffe5a)
Document spec.server.port for host-network port conflicts, and describe
how user-managed LoadBalancer and NodePort Services must align port and
targetPort with the CR.
Signed-off-by: raaizik <raaizik@yahoo.com>
Co-Authored-By: Blaine Gardner <b.blaine.gardner@gmail.com>
(cherry picked from commit a400ae6fd5)
Add coverage for GetPort defaults and custom values, Service and probe
port wiring, Ganesha NFS_Port config, and create-or-update when
spec.server.port changes on an existing Service.
Signed-off-by: raaizik <raaizik@yahoo.com>
(cherry picked from commit b97296c47c)
When NFS runs with host networking, port 2049 may already be in use.
Add CephNFS spec.server.port (default 2049), wire it through Ganesha
config, the operator Service, and probes, and regenerate CRDs.
Signed-off-by: raaizik <raaizik@yahoo.com>
(cherry picked from commit 5e36fa4bc3)
When the active MGR IP already exists at a non-zero position in the
externalMgrEndpoints list, the rotation logic that replaces endpoints[0]
creates duplicate IPs. Also guards against mgr map failure which could
overwrite endpoints[0] with an empty string.
Fixes: #17761
Signed-off-by: beyondcloud-co <87993136+beyondcloud-co@users.noreply.github.com>
(cherry picked from commit 8134d683e3)
The go text package v0.37 has a vulnerability, thus update
to the latest version of the package.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 8c397f6381)
assignMons schedules each mon in its own goroutine and shares a
failedMonSchedule bool to record whether any of them failed. The
resultLock mutex already guards the shared c.mapping.Schedule map
write, but the three failedMonSchedule = true assignments were done
without holding the lock. When two or more mons fail to schedule at
the same time (for example when waitForMonitorScheduling errors, the
node choice is nil, or getNodeInfoFromNode fails) their goroutines
write the flag concurrently, which is a write-write data race.
Guard the failedMonSchedule writes with the existing resultLock, the
same lock the goroutines already use for the map update. The post-Wait
read is left as is since the WaitGroup orders it after every write.
Add a regression test that fails scheduling for multiple mons at once
and confirms assignMons returns an error; run it with -race to catch
the race.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit 0bbd5de84c)
decodePeerToken logged the whole decoded PeerToken with "%+v" at debug
level. PeerToken embeds Key, the peer cluster's cephx auth secret, so
running the operator with ROOK_LOG_LEVEL=DEBUG wrote that credential to
the operator logs in plaintext (CWE-532).
Log only the non-sensitive fields (fsid, client id, mon host, namespace),
which keep the message useful for diagnostics, and drop Key. Add a
regression test that captures the debug output and asserts the key is
never present.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit 1013a8effc)
The Placement field comments on RBDMirroringSpec and
FilesystemMirroringSpec both read "The affinity to place the rgw pods",
copied from GatewaySpec. Neither spec manages RGW pods: RBDMirroringSpec
configures the rbd mirror daemon and FilesystemMirroringSpec the
cephfs-mirror daemon.
Update the comments to name the correct pods, matching the wording
already used by the sibling Resources and PriorityClassName fields in
each struct, and regenerate Documentation/CRDs/specification.md so the
published CRD API reference matches.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit b26cad41ef)
currently there was a bug in the code where it didnt removed
the account from the ceph cluster during intial intialize
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit cca7020f0b)
Expand the Node Loss section in block-storage.md to accurately describe the automatic fencing flow, and add dedicated Network Fencing sections across the CSI documentation to provide configuration examples for both manifest-based and Helm-based deployments.
* block-storage.md: introduce the Network Fencing prerequisite paragraph with links to the new example sections, replace the single-line "auto-fencing" description with three bullets describing the client blocklist flow, and update Node Recovery to a single sentence covering workload rescheduling and the 5-minute cool-down behavior that triggers automatic unblocklist. Add a Warning admonition instructing administrators not to remove the out-of-service taint before the node completes a full power cycle.
* csi-configuration.md: add a Network Fencing section enumerating the three prerequisites (CSI-Addons controller, CSI-Addons sidecar, enableFencing flag) and showing the RBD Driver CR manifest with deployCsiAddons and enableFencing set together.
* csi-drivers-chart.md: add a Network Fencing subsection under Custom settings showing the per-driver Helm values for deployCsiAddons and enableFencing, with a cross-reference to csi-configuration.md.
* ceph-csi-drivers.md: replace the legacy CSI_ENABLE_CSIADDONS configmap patch in the Enable CSI-Addons Sidecar section with the modern deployCsiAddons approach on OperatorConfig or Driver, and add a Network Fencing overview section that links out for configuration details and the operational flow.
Signed-off-by: N3rdBot <wujiafeng17@gmail.com>
(cherry picked from commit bc8d40095d)
Configure the CephHelmSuite object store as an RGW multisite zone so the
chart's CephObjectRealm, CephObjectZoneGroup, and CephObjectZone templates
are exercised on a Helm install. The operator must reconcile the realm,
zone group, zone, and store to Ready, which the existing install check
already gates on via the RGW pod count.
The realm/zone group/zone and shared-pool layout mirror the fixture in
tests/integration/object/util/sharedstore: a zone backed by explicit
CephBlockPools referenced through sharedPools.poolPlacements. The rgw pools
are appended to the block pools already configured for CSI, and are torn
down along with the multisite CRs when the default storage CRs are removed.
Gate the multisite configuration behind a new UseMultisiteObjectStore
setting enabled only for CephHelmSuite. The other Helm-based suites keep the
plain object store; the upgrade suite in particular installs an older base
chart that lacks the multisite templates and cannot resolve a zone-based
store.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8a72d80127)
# Conflicts:
# tests/integration/ceph_helm_test.go
Add optional CephObjectRealm, CephObjectZoneGroup, and CephObjectZone
resources to the rook-ceph-cluster chart so an RGW multisite topology can
be deployed from the chart alongside CephObjectStore.
Each resource type follows the existing per-list template idiom: a new
template ranges over a values list and renders name, namespace, and spec.
The realm template renders spec only when set, supporting both a new realm
(no spec) and a pulled realm (spec.pull.endpoint).
The three lists ship commented out in values.yaml with a multisite
example, matching the opt-in cephECBlockPools precedent, so a default
install creates no multisite resources.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8989bff653)
Aggregate pool usage by pool before predict_linear to avoid duplicate series after mgr pod replacement, and add a one-hour hold time to match the source rule update in ceph/ceph#68621.
Signed-off-by: Jeff Wallace <jeff@tjwallace.ca>
(cherry picked from commit 5119f3aeb4)
CephFS reconciliation loop on Filesystem creation was swallowing errors.
The err variable which contained the error was replaced with the resulted error from the
kubernetes update status call on the CRD.
This commit fixes that and aggregate both errors in case there is both a kubernetes status update failure and a creation error.
Signed-off-by: Maxime Bertin <mbertin@luccasoftware.com>
(cherry picked from commit 0696b24d9c)
This change fixes some of the broken links in the markdown
documentatoion sources found by the markdown link checker.
Assisted-by: IBM Bob
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit a70d68b882)
currently, drbd hostname was ready using command
but now the change we use kubernetes built-in api
to read hostname from `spec.nodeName`.`
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit c49ef5f079)
Joshua Hoblitt
mergify[bot]
Travis Nielsen
raaizik
beyondcloud-co
Michael Adam
Joshua Hoblitt
Anas Khan
parth-gr
N3rdBot
Jeff Wallace
Maxime Bertin
subhamkrai