This commits removes controller-runtime dependencies
from the apis dir and to achieve that we are removing
webhook.
Signed-off-by: subhamkrai <srai@redhat.com>
Use K8s LivenessProbe mechanism to check OK-status of nfs-ganesha
container. A user may define his own lineness-probe, or a default one
which expects NFS TCP-port 2049 to be active; that is, willing to accept
new connections: for Ceph>=18.2.1 issue 'rpcinfo' call on local pod;
otherwise use standard K8s TCP-socket liveness probe mechanism.
Define permissive values to liveness-probe to ensure that the NFS
service is defined in failed-state only when it has non-recoverable
error.
The current default definition of LivenessProbe is expected to guard the
nfs pod from at least the following two cases:
- Deadlocks: where an nfs-ganesha server is running, but unable serve
new connections due to internal bad-state.
- Resource exhaustion on the host node (e.g. OOM) which prevents the
server from accepting new connections and reply to NULL RPC request.
In both cases we expect K8s to reschedule the nfs pod, most likely on
different host node.
Refs rook issue #12719
Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Change how Rook detects network CIDRs for Multus networks. The IPAM
configuration is only defined as an arbitrary string JSON blob with a
"type" field and nothing more. Rook's detection of CIDRs for whereabouts
had already grown out of date since the initial implementation.
Additionally, Rook did not support DHCP IPAM, which is a reasonable
choice for users. And more, Rook did not support CNI plugin chaining,
which further complicates NADs. Based on the CNI spec, network chaning
can result in any changes to network CIDRs from the first-given plugin.
All these problems make it more and more difficult for Rook to support
Multus by inspecting the NAD itself to predict network CIDRs. Instead,
it is better for Rook to treat the CNI process as a black box. To
preserve legacy functionality of auto-detecting networks and to make
that as robust as possible, change to a canary-style architecture like
that used for Ceph mons, from which Rook will detect the network CIDRs
if possible.
Also allow users to specify overrides for CIDR ranges. This allows Rook
to still support esoteric and unexpected NAD or network configurations
where a CIDR range is not detectable or where the range detected would
be incomplete. Because it may be impossible for Rook to understand the
network CIDRs wholistically while residing only on a portion of the
network, this feature should have been present from Multus's inception.
Improving CIDR auto-detection and allowing users to specify overrides
for auto-detected CIDRs rounds out Rook's Multus support for CephCluster
(core/RADOS) installations. No further architectural changes should be
needed for CephClusters as regards application of public/cluster network
CIDRs for Multus networks.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
We need to restart all the ceph daemons whenever
cephCluster network settings are modified like
requiremsgr2, encryption and compression. This
required for Ceph to consider the new settings
it require new ceph daemons all over.
Signed-off-by: subhamkrai <srai@redhat.com>
When the dbus-daemon in the sidecar is started as "root" user, it fails
with the following log entry:
Failed to start message bus: Failed to drop capabilities: Operation not permitted
By starting the sidecar as "dbus" user (uid=81), the executable does not
try to drop capabilities, and starts successfully.
Signed-off-by: Niels de Vos <ndevos@ibm.com>
Some logging instructions use formatting syntax `%q`, but the logging method is
`Info` or `Debug` instead of `Debugf` and `Infof`. As a result, the arguments of
the method were concatenated instead of formatted properly.
Signed-off-by: Lucas Henry <polyedre@disroot.org>
0a151e913 results in a bug which causes null pointer dereference when
Kerberos is not setup. This causes a failure in Unit test
TestReconcileCephNFS_addSecurityConfigsToPod
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
This will enable us to use GSSAPI in sssd for authentication when
connecting to the remote LDAP server.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
We add a new field domainName to the Kerberos section. The field is used
to setup /etc/idmapd.conf with the domain name. This allows idmapper to
map to kerberos credential to the correct uid/gid.
We add Spec.Security.Kerberos.DomainName to the CRD
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Pare down the available volume sources for NFS config files so that the
CRD isn't unnecessarily huge. This allows us to recommend
`kubectl apply` again in the upgrade doc.
Size of the NFS CRD is reduced by approximately 60%.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
When using sssd, the /etc/nsswitch.conf should also include local files
for lookups. This is required when looking up uid 0 and the root user
which are not handled by ldap or other sources.
Closes: https://github.com/rook/rook/issues/11925
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Adding the search domain localhost causes lookup failures.
Many DNS servers have a wildcard entry *.localhost which returns
127.0.0.1. Adding a "search localhost" to resolv.conf appends a
".localhost" for every host lookup for which the DNS server returns
127.0.0.1 which causes failures further down the execution path.
example: with localhost in the search domains
# ping google.com
PING google.com.localhost (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.071 ms
Closes: https://github.com/rook/rook/issues/11870
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
wihtout RGW section, nfs daemon could not setup correctly with rgw export for rados authentication. Eventually it ends up in crash loop.
change to use double quotes for string as designated in ganesha documentation.
Bug to fix: 11592
Signed-off-by: Ben Gao <bengao168@msn.com>
Add a hostNetwork option for a Ganesha server.
This allows you to use host networking for the cluster but still
use regular pod networking for NFS Ganesha servers
Signed-off-by: Richard Bateman <taxilian@gmail.com>
few functions got change as they were deprecated
for ex: ioutil.Readfile change to os.Readfile
ioutil.TempFile change to os.CreateTemp
And fixed golang-ci-lint-issues
Signed-off-by: parth-gr <paarora@redhat.com>
Run the ganesha-rados-grace command in a remote pod when multus
networking is enabled.
Signed-off-by: parth-gr <paarora@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Introduce a new env variable ROOK_CSI_IMAGE_PULL_POLICY in rook operator configmap which should be used to
customize the imagePullPolicy for the csi driver and imagePullPolicy property in cephVersionSpec for ceph pods.
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
The sssd.conf may refer to additional files, like a CA bundle or TLS
certificates. These files need to be made available in the SSSD sidecar.
With the new `sssdGenericFiles` reference to a VolumeSource and a
`MountPath`, a provided `sssd.conf` can use the additional files.
Signed-off-by: Niels de Vos <ndevos@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
if Multus is enabled the clusterinfo should be updated with
network as multus as to run the ceph cmds in remote
executor
Signed-off-by: parth-gr <paarora@redhat.com>
Implement the SSSD sidecar design for NFS.
Because NFS documents are getting long, create an NFS
`Storage-Configuration` section with separated topics to keep the `NFS
Overview` document sane.
Adjust the SSSD design to allow any VolumeSource, not just ConfigMaps.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
With octopus coming to end of life, we remove support from
Rook for deploying Ceph Octopus and assume a min version of
Pacific v16. Any checks for octopus or earlier are removed
from the reconciles since they are obsolete.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Ceph added a check recently that prevents creation of the
built-in pools that start with a dot, such as .nfs, .mgr,
and .rgw.root. These pools require a --yes-i-really-mean-it
flag to be passed to force the creation now.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CSI package needs to load clusterInfo, today this code is in the mon
package which makes the call of LoadClusterInfo impossible without
having a circular import.
Signed-off-by: Sébastien Han <seb@redhat.com>
Create the ".nfs" config pool by default so that users aren't required
to create it via CephBlockPool.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
adding observedGeneration field in the cephcluster cr
status for having better control on reconciling,
as observedGeneration field will be updated by the controller
Closes: https://github.com/rook/rook/issues/9673
Signed-off-by: parth-gr <paarora@redhat.com>
When downscaling CephNFS clusters, be sure to remove secrets and
configmaps. Also be sure to only downscale for the currently-reconciling
CephNFS cluster.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Prior to this, we were comparing a pointer (the memory address) with a
struct. This was obviously always failing and returned false. We must
dereference the pointer to access the data contained at that memory
location.
Closes: https://github.com/rook/rook/issues/9544
Signed-off-by: Sébastien Han <seb@redhat.com>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Remove the poolConfig in CephNFS to prevent different CephNFS CRs from
contending to change the replication spec of the default NFS pool.
Resolves#9355
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
Previously, if the pool was present we would not run the pool creation
again. This is a problem if the pool spec changes, the new settings will
never be applied.
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit adds context parameter to k8sutil job functions. By this, we
can handle cancellation during API call of job resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
When the configuration configmap is updated for a CephNFS server, the
NFS application should restart to ensure it is running with the latest
config.
Fixes#9028
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Ths NFS spec now supports the CephBlockPool spec which means that it can
take advantage of all the known settings like compression, size, failure
domain etc.
Closes: https://github.com/rook/rook/issues/9034
Signed-off-by: Sébastien Han <seb@redhat.com>
The cluster CR can be forcefully deleted and cleanup the
cluster resources if the yes-really-destroy-data policy
is set on the CR. In this case, the other controllers should
treat the cluster CR as not existing and allow the finalizers
to be removed on those resources if they are requested for
deletion.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
subhamkrai
travisn
Shachar Sharon
Blaine Gardner
Niels de Vos
Lucas Henry
Sachin Prabhu
Blaine Gardner
Ben Gao
Richard Bateman
parth-gr
Avan Thakkar
Niels de Vos
Joseph Lee
Josh Soref
Sébastien Han
Yuichiro Ueno