When a mon is failed over, the old mon is left in mon quorum
until the new quorum is confirmed in quorum. When host networking
is enabled, this may result in two mons being in quorum with the
same ip, if the new mon is scheduled on the same node as the
down mon. This results in daemon crashes in the cluster since
they are confused by multiple of the same ip in the mon map.
The solution is to avoid scaling down the bad mon when host networking
is enabled. This will ensure the new mon is not scheduled on the
same node as the previous mon. With host networking, either another
node is necessary or the original mon must come back online to
restore quorum.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
currently, we're setting the env `DISCOVER_DAEMON_UDEV_BLACKLIST`
in operator.yaml but we're not reading from the operator env and
setting the value to discover pod env.
Signed-off-by: subhamkrai <srai@redhat.com>
If the node for an OSD does not exist within kubernetes, the PDB
reconciliation logic will fail to make progress. This can be problematic
as new OSDs added to the cluster may not be protected by OSD PDBs after
they are added since the PDB reconcilation logic is failing.
The solution is to treat non existing OSD nodes as drained which is
logically consistent with treating unschedulable OSD nodes as drained as
you cannot schedule a pod onto a node which does not exist.
Fixes: #16086
Signed-off-by: Elias Carter <elias@dropbox.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
If RemoveSecret is set remove the secret.
if not set, do below
check if the current cephClient is owner if
secret is present, if not return as its owned
by other controller, if its not present create
or update the secret.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
When the csi-operator is enabled no need to update
the cm rook-ceph-csi-config configmap.
Otherwise operator will complain about the error
```yaml
ceph-cluster-controller: failed to reconcile CephCluster "rook-ceph/rook-ceph". failed to reconcile cluster "rook-ceph": failed to configure local ceph cluster: failed to create cluster: failed to start ceph monitors: failed to initialize ceph cluster info: failed to save mons: failed to update csi cluster config: waiting for CSI config map to be created: configmaps "rook-ceph-csi-config" not found
```
Signed-off-by: subhamkrai <srai@redhat.com>
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
Create a new OSD pod init container that loads the latest CephX key for
the OSD. The init container must be run after OSD activation, due to
keyfile reset behavior of ceph-bluestore-tool, used during activation.
The primary purpose of this work is to allow OSDs to start and run
correctly after key rotation, whether done manually by users or
automatically by future Rook work.
This work makes redundant prior code changes done in #14826. The CI test
added in the prior work is kept to ensure no regression.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
The rados namespace status was not reporting if the namespace
was empty. Now the condition will be properly updated if
it is empty.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
currently it was using two tabs, but
others config are using one tab
So update the config to use one tag
Signed-off-by: parth-gr <partharora1010@gmail.com>
currently nfs is used as the unique selector
for daemon id, which returns nfs: ocs-storagecluster-cephnfs-a
Updating the has() to function to check the same label value
(n.Name + "-" + id)
Signed-off-by: parth-gr <partharora1010@gmail.com>
this commit remove the code which sets the dmcrypt encryption
key from secret as environment variable in the prepare pod job
spec. Now, the env will be set under function `setKEKinEnv`, which
tries to reads secret from k8s first method `c.IsK8s()`under
`GetSecret` and then check for KMS to ready and apply env directly.
Signed-off-by: subhamkrai <srai@redhat.com>
update comment to correctly state that reconcilecephcluster
manages the cephcluster object, not cephfilesystem.
Signed-off-by: Oded Viner <oviner@redhat.com>
This change cleans up and standardizes import statements across the Ceph operator code. It removes redundant or duplicate imports and reorganizes alias names for improved clarity and consistency. Additionally, the ST1019 exception was removed from .golangci.yaml now that the code complies with the rule.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
This change adds support for skipping reconciliation of CephNFS daemons
that are labeled with `ceph.rook.io/skip-reconcile=true`.
Similar to MDS, MGR, and RGW components, this allows cluster operators
to prevent Rook from modifying specific NFS daemon deployments.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
Refactored multiple conditional if-else blocks into switch statements to improve readability and maintainability. Also removed outdated staticcheck rule comments (QF1002, QF1003) from .golangci.yaml.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
Labels cannot be longer than 64 characters, and if the image name
is too long we log a verbose message about the label that we can
just log now as debug level.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
when a reconcile returns a requeue result without an error
(e.g. due to a missing cephcluster), the previous logic reported
it as a successful reconcile. this was misleading and made it
hard to understand the actual controller behavior this
change adds a new condition to log and emit a "requeuing" event
when reconcileResponse.Requeue is true and err is nil.
this ensures more accurate event reporting and improves observability across
all controllers using reportreconcileresult.
Signed-off-by: Oded Viner <oviner@redhat.com>
Santosh Pillai
Oded Viner
Blaine Gardner
Travis Nielsen
subhamkrai
Elias Carter
raaizik
Madhu Rajanna
Muhammad Adil Ghaffar
subham rai
Kyori Sakao
Patryk Rostkowski
Praveen Hosamani
parth-gr
Carlos Barria