rbd nodeplugin need volumeattachment RBAC
to remount the volume incase of the nbd driver
is used to mount the volume.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Currently cephfs caps are data=filesystemname,
which only have write access, but not the read access
changing it to *=filesystemname so we can read data also
Signed-off-by: parth-gr <paarora@redhat.com>
The `watch` verb is not required for the csi-snapshotter sidecar
to function, removing it from the deployment
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Now rgw can be pass by FQDN too,
to avoid problems where it is required
The format should be similar to
Ip(<IP>:<PORT> format), <FQDN>:<PORT> format
Signed-off-by: parth-gr <paarora@redhat.com>
Currently it was mention we are updating the csi-user
But more precisely we go and update the keyrings
which auto update users so replacing it
Signed-off-by: parth-gr <paarora@redhat.com>
The ceph-external-cluster-details-exporter.py
generates the json output even with
rgw-endpoint IP from different cluster
Added a check validate_rgw_endpoint which will validate
the above rgw_endpoint Ip by matching the cluster fsid
Signed-off-by: parth-gr <paarora@redhat.com>
This commit adds psp RoleBindings to rook-ceph-rgw role and
rook-ceph-purge-osd role. Without this commit, I cannot perform
rook-ceph-purge-osd job on PSP-enabled cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
The operator is very bursty and when starting up may need more memory
to reconcile all the CRs initially before it calms down.
The default of 256Mi was not sufficient for many clusters, so now
we bump up the limit to 512Mi.
This is a follow-up from the same change to the helm chart in
https://github.com/rook/rook/pull/10195.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Added hack in generate-rook-csv for proper
generation of csi nfs rbac in csv.
Added placeholder clusterrole and binding for
nfs nodeplugin sa, since operator-sdk
does not include sa without rules.
Signed-off-by: Rakshith R <rar@redhat.com>
With https://github.com/rook/rook/pull/10108 a placeholder role
and role binding were added for the rgw service account so
the csv generation would generate the service account. That
workaround also requires a rule to be added to the role or else
the generation is invalid. Now a rule is added to avoid that
issue. In the future we need to remove this role and binding
when the operator sdk is updated as explained in
https://github.com/rook/rook/issues/10141
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The endpoint on the rgw realm pull spec is causing a failure
if not specified even when it is not expected to be
required. Now the endpoint has the json property to be
ommitted if not specified.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The csv will not properly include the rook-ceph-rgw service
account unless there is a role and binding that references
the service account. No roles are needed yet for the rgw
daemon, so this will add a placeholder only for the purposes
of csv generation.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
By default, we should set the priority class to one of the built-in
priority class names to ensure that pods critical to the storage
will be able to remain running when resources are low. Otherwise,
critical rook pods could be evicted and affect many other pods
that rely on the storage to continue functioning. The options have
been available in the CRs, but until now we have just not set the
defaults in the examples. Critical rook components are now set to
the priority class system-node-critical if they are generally pinned
to a node, and system-cluster-critical if they are critical to the storage.
Some pods such as the operator and crash collector do not have a
default priority class set in the examples since they don't affect
the data path.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The ceph adm alerts were included in the latest prometheus
rules. With rook these alerts will never be triggered, so
we remove them.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The new alerts picked up for Rook v1.9 directly from the ceph repo
were not all rook-compliant. The alert for the prometheus job not
running is not needed since Rook and K8s go to great lengths to
keep the mgr pod running already.
The alert for the cluster filling up soon is also disabled
until we find how to get the formula working in rook clusters.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Fix a small permission (RBAC) issue with the operator-on-openshift.yaml
example's SecurityContextConstraint. A ServiceAccount reference for the
Ceph CSI NFS provisioner was missing.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
setting the GRPC timeout configurable helps
in some cases where ceph cluster takes more time
to respond.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Update the NFS docs with the latest available info for Ceph Quincy
including the CSI provisioner driver.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Ceph-CSI supports LUKS encryption for RBD volumes.
This commit adds support for the same by adding capability
of mounting required `rook-ceph-csi-kms-config` configmap
into csi-rbdplugin-provisioner and nodeplugin pods.
Required documentations, helm charts and examples yamls
are also updated.
Resolved: #7032
Signed-off-by: Rakshith R <rar@redhat.com>
Because the NFS CSI driver is optional and rarely deployed, make RBAC
for this driver an optional example that is generated by the helm chart.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Create the ".nfs" config pool by default so that users aren't required
to create it via CephBlockPool.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Adds support for valid arbitrary NodeAffinity JSON input by the user while
maintaining backward compatibility with the older parsing code.
Signed-off-by: Pranshu Srivastava <rexagod@gmail.com>
Madhu Rajanna
parth-gr
Travis Nielsen
Humble Chirammal
Sébastien Han
Sean Johnson
Yuichiro Ueno
Rakshith R
subhamkrai
Yuval Manor
Blaine Gardner
Pranshu Srivastava