Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.
5.7.3 Apply Security Context to Your Pods and Containers
When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
When the MDS liveness probe times out, it should not fail the probe. If
the cluster has a network partition or other issue that causes the Ceph
mon cluster to become unstable, `ceph ...` commands can hang and cause
a timeout. In this case, the MDS should not be restarted so as to not
cause cascading cluster disruption.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
If the mon failover is in progress, ensure the removal
of an extra mon deployment is skipped since that code
path only has one mon in the list for the mon that was
just newly started. The extra mon was erroneously removing
a random mon in that case, followed immediately by the mon
failover completing and removing the expected failed mon,
and potentially causing mon quroum loss.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
These fields must be optional in order to allow usage of pre-existing
pools managed by CephBlockPool CR(s).
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
When attempting to use pre-existing (or cephBlockPool managed) pools and
the cephObjectStore.spec.{metadataPool,dataPool} fields are not
specified, rgw creation will fail with this error:
2024-09-25 21:00:17.744358 E | ceph-object-controller: failed to reconcile CephObjectStore "rook-ceph/test1". failed to create object store deployments: failed to create object pools: failed to create metadata pools: failed to create pool "test1.rgw.control": pool "test1.rgw.control" type is not defined as replicated or erasure coded
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Given that Ceph Quincy (v17) is past end of life,
remove Quincy from the supported Ceph versions,
examples, and documentation.
Supported versions now include only Reef and Squid.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This adds an operator config setting ROOK_REVISION_HISTORY_LIMIT
defaulting to kubernetes'value for RevisionHistoryLimit.
If configured, the provided value will be used as RevisionHistoryLimit
for all Deployments rook creates.
Fixes: #12722
Signed-off-by: Michael Adam <obnox@samba.org>
deployments on openshift where we need csi container pods
to be run on privileged, the logrotate sidecar container was missing the
privileged permission letting, side car to not run properly
Signed-off-by: parth-gr <partharora1010@gmail.com>
default application name is updated inside the `CreatePool` method. Send
pool spec as address in order to preserve this change.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
The crash collector daemon had missed the ability to
add custom annotations via the cephcluster CR, as already
supported for all the other daemons.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When pool placements were recently added to the object store CRD, it
seems that codegen didn't get run, and Rook's CI didn't accurately catch
the codegen issue. This will address adding the missing generated code.
Follow-up work will address fixing CI so that it doesn't continue
missing when codegen needs to be run.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The crush rules may have a negative step num.
Rook had assumed negative values were not possible,
but just had not been encountered previously in
a custom crush rule.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
to keep it simple we'll not delete the csi-operator resources
we'll only document this for users who want to switch to csi-drivers.
Anyways by next release we'll only support csi-operator only.
Signed-off-by: subhamkrai <srai@redhat.com>
This new setting is of Boolean type and defaults to "false".
When set to "true", it changes the behavior of the
rook operator to
nable host network on all pods created by the cephcluster controller
new method to check the setting: opcontroller.EnForceHostNetwork()
Signed-off-by: Michael Adam <obnox@samba.org>
When removing a mon from quorum, there is a race condition that
can result in mon quorum going being lost at least temporarily.
The mon pod was being deleted first, and then the mon removed
from quorum. If any other mon went down between the time the
pod of the bad mon was deleted and when the mon was removed from
quorum, there may not be sufficient quorum to complete the
action of removing the mon from quorum and the operator would
be stuck.
For example, there could be 4 mons temporarily due to timing
of upgrading K8s nodes where mons may be taken down for some
number of minutes. Say a new mon is started while the down
mon also comes back up. Now the operator sees it can remove
the 4th mon from quorum, so it starts to remove it. Now say
another mon goes down on another node that is being updated
or otherwise drained. Since the 4th mon pod was deleted
and another mon is down, there are only two mons remaining
in quorum, but 3 mons are required in quorum when there
are 4 mons. Therefore, the quorum is stuck until the
third mon comes back up.
The solution is to first remove the extra mon from quorum
before taking down the mon pod.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When doing the clean-up of raw device OSDs, it was not taking metadata
and wal devices into account. This commit discover them via the output
of `ceph-volume raw list`, which is returning `device_db` and/or
`device_wal` if they are present.
After discovering the metadata and wal device it also clean them and
close the encrypted device if any.
Signed-off-by: Mathias Chapelain <mathias.chapelain@proton.ch>
Allow RGW users to mount arbitrary volumes to RGW pods. This follows the
pattern that was established for NFS to support SSSD and LDAP, and
reuses much of the same code.
This opens the door wider for advanced users to take advantage of some
Ceph RGW features that Rook doesn't have first class support for.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Only single pool will get created if there are multiple
data pool entries with same name. This PR just adds a check
to fail if duplicate pools are present.
Signed-off-by: sp98 <sapillai@redhat.com>
Previously, Rook would fail to create monitors for a `CephCluster` spec that
required them to be located in distinct failure domains:
```yaml
spec:
mon:
count: 3
failureDomainLabel: topology.kubernetes.io/zone
zones:
- eu-central-1a
- eu-central-1b
- eu-central-1c
```
This was due to the fact that Rook was mistakenly getting the
`failureDomainLabel` from `spec.mon.stretchCluster.failureDomainLabel`.
This commit ensures `spec.mon.failureDomainLabel` is being used instead, which
fixes the cluster deployment for the spec above.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
Alerting on controller-runtime's workqueue_depth can be useful for
debugging controllers. Also having a prometheus target for a pod gives
another data point that the system is working as expected. It is useful
for uptime alerts.
Make the bind address configurable via the configmap while still retaining the default
behavior that it is disabled.
Resolves: #14538
Signed-off-by: Justin Cichra <jcichra@cloudflare.com>
Peter Razumovsky
Travis Nielsen
subham rai
Blaine Gardner
Joshua Hoblitt
Michael Adam
parth-gr
Santosh Pillai
subhamkrai
parth-gr
Praveen M
dependabot[bot]
Artem Torubarov
Madhu Rajanna
Artem Torubarov
Mathias Chapelain
Benoît Knecht
chanyoung
Justin Cichra