In the Alpha Version of the VolumeGroupSnapshot
Feature the flag to enable the feature was
`--enable-volume-group-snapshots=true` and in the beta
API the feature is diasbled by default to enable it
we need to set `--feature-gate=CSIVolumeGroupSnapshot=true`
There is a change in the flag between the API version
This PR add a code where we choose the required
flag based on the API version.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.
5.2.8 Minimize the admission of containers with added capabilities
Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.
5.7.3 Apply Security Context to Your Pods and Containers
When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
deployments on openshift where we need csi container pods
to be run on privileged, the logrotate sidecar container was missing the
privileged permission letting, side car to not run properly
Signed-off-by: parth-gr <partharora1010@gmail.com>
issue:
external-provisioner (v5) enabled topology feature-gate by default
and the current implementation in Rook uses a conditional block to
enable the topology feature gate. This approach now does not directly
reflect the state of the `CSI_ENABLE_TOPOLOGY`.
fix:
replacing the conditional block with a direct use of the
`CSI_ENABLE_TOPOLOGY` for flag value.
Signed-off-by: Praveen M <m.praveen@ibm.com>
This commit adds the flexibility to configure kube apiserver qps
as per the user requirement and also keeps the existing values as
the default one.
Signed-off-by: yite.gu <yitegu0@gmail.com>
Use the same logrotate flow of rbd, as merged in #14305
1) Make the csi cephfs and nfs container logs persisted in a file
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
And some fixes on the implementation:
1) Add a operator namespace in the log file path
2) Only add volume to the container if logrotate is enabled
Closes: https://github.com/rook/rook/issues/12809, https://github.com/rook/rook/issues/14429
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the recent enhancements csi containers for using
logrotate, they need to run with securityContext to privileged,
on platform like openshift.
Used the ROOK_HOSTPATH_REQUIRES_PRIVILEGED flag
wich is set with operator deployment to see
if the securityCOntext is needed or not
Closes: https://github.com/rook/rook/issues/14400
Signed-off-by: parth-gr <partharora1010@gmail.com>
1) Make the csi rbd container logs persisted in a file
(csi plugin, csi provisioner, csi addons sidecar)
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
part-of: https://github.com/rook/rook/issues/12809
Signed-off-by: parth-gr <partharora1010@gmail.com>
Ceph-CSI support for fscrypt encryption of cephfs.
To achieve this commit add capability of mounting the
required `rook-ceph-csi-kms-config` configmap into
csi-cephfsplugin-provisioner and nodeplugin pods.
Further it modifies the ClusterRoles `cephfs-csi-nodeplugin` and
`cephfs-external-provisioner-runner` to grant privileges
required for reading encryption configuration and fetching
encryption secrets from either kubernetes secrets or
from a Key Management System (KMS).
These privileges are essential for the proper functioning of
ceph-csi-cephfs with fscrypt encryption.
The following privileges have been added:
- `secrets/get`: Allows reading of secrets for encryption.
- `configmaps/get`: Grants access to configuration maps,
this is used to read encryption configuration.
- `serviceaccounts/get`: Enables retrieval of service accounts for
authentication to KMS and for retrieving encryption secrets
stored there.
- `serviceaccounts/token/create`: Allows creation of service account tokens,
which are required for authenticating requests to KMS
when retrieving encryption secrets.
The commit also updated the csi documentation to include cephfs
in the encryption section, with examples updated accordingly.
Signed-off-by: NymanRobin <robin.nyman@est.tech>
volumegroupsnapshot feature will be enabled
by default if the required CRD's are present
if not its disabled and user will have an option
to disable it if they dont require this feature.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit removes the `CSI_ENABLE_READ_AFFINITY` since
it is no longer utilized after addition of the read affinity
option per cluster via CSIDriverSpec.
Signed-off-by: Praveen M <m.praveen@ibm.com>
This commit adds the flexibility to configure
leader election flags as per the user
requirement and also keeps the existing values
as the default one.
resolve: #13475
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
GRPC metrics got deprecated in cephcsi
3.7.0 and the deprecated flags will get
removed in the next release. This PR
removes the deprecated metrics code which
allow us to run with older cephcsi as well.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
If mountinfo path is available cephcsi will
try to recover the fuse client. adding the
support for the same in Rook.
fixes: #13009
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Adding maxUnavailable parameter to the cephfs csi daemonset. The
default value of maxUnavailable = 1 can make the upgrade process
slower in environments with large number of nodes.
Fixes: #12636
Signed-off-by: karthik-us <ksubrahm@redhat.com>
adding drop `ALL` capabilities in rook operator container
as this is not required and will remove warning in ocp cluster.
Signed-off-by: subhamkrai <srai@redhat.com>
This commit removes k8s version check for oidc token
which required k8s v1.20 or above since minimum
k8s version that rook supports now is v1.22.
Signed-off-by: Rakshith R <rar@redhat.com>
adding a option to make AttachRequired field
as configurable and added a comment to explain
the consequences of changing the default value
resolves: #11805
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit adds code to supply variables required
to enable read affinity for rbd volumes.
It leverages `read_from_replica=localize,crush_locations=key:value`
krbd map option from ceph to serve reads from the most local OSD.
refer:
https://docs.ceph.com/en/latest/man/8/rbd/#kernel-rbd-krbd-options
Signed-off-by: Rakshith R <rar@redhat.com>
The default value of maxUnavailable of daemonset is 1.
Sometimes the upgrade can be slow due to this setting.
So I add a parameter to change the value for rbd daemonset.
Signed-off-by: Shinya Hayashi <shinya-hayashi@cybozu.co.jp>
Co-authored-by: Toshikuni Fukaya <toshikuni-fukaya@cybozu.co.jp>
Co-authored-by: Yuji Ito <llamerada.jp@gmail.com>
The omap generator sidecar is the one who
sets the pvc name and clustername in the metadata
if the pv is re-attached to a new pvc or if the
clustername changes, for that reason we need to
set these flags on the omap generator sidecar
also.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Introduce a new env variable ROOK_CSI_IMAGE_PULL_POLICY in rook operator configmap which should be used to
customize the imagePullPolicy for the csi driver and imagePullPolicy property in cephVersionSpec for ceph pods.
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
This commit adds topology provisioning
support. This makes modification to rbac,
csi deployment and daemonset.
Signed-off-by: Rakshith R <rar@redhat.com>
This commit removes controller-ip parameter from
csi-addons sidecar as it is no longer required to be
passed.
Signed-off-by: yati1998 <ypadia@redhat.com>
The volume replication operator is being moved to
kubernetes-csi-addons. This commit hence, removes
the volume replication sidecar and updates the
related documentation.
It will also update the csi-addons sidecar version
to the latest one.
Closes: #10655
Signed-off-by: yati1998 <ypadia@redhat.com>
This commit adds holder pod support
for nfs to be able to work in non-host
networking scenario, without being
affected by restarts of csi-nfsplugin.
Signed-off-by: Rakshith R <rar@redhat.com>
Cephcsi v3.7 now supports nfs nodeserver.
This commit changes nfs nodeserver image to
cephcsi image and makes other necessary
modifications to template.
Signed-off-by: Rakshith R <rar@redhat.com>
One can now use the operator configmap for CSI_CLUSTER_NAME variable
for setting ClusterName on the RBD images and CephFS subvolume.
This will be useful in cases like for example, when two container orchestrator
clusters (Kubernetes/OCP) are using a single ceph cluster.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
One can now tweak the operator configmap for CSI_ENABLE_METADATA boolean to
enable/disable setting of PV/PVC/PVCNamespace &
snapshot-name/snapshot-namespace/snapshotcontent-name on the RBD images
and CephFS subvolume.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Skala Networks
Madhu Rajanna
Peter Razumovsky
Blaine Gardner
parth-gr
Praveen M
Travis Nielsen
yite.gu
parth-gr
NymanRobin
Niels de Vos
Riya Singhal
karthik-us
subhamkrai
Rakshith R
Humble Chirammal
Avan Thakkar
yati1998
Prasanna Kumar Kalever
Mudit Agarwal