when using encryptedDevice:true with host based (non pvc) osds, resizing
the underlying disk and restarting the OSD didn't expand the OSD because
the LUKS encryption layer was not resized.
This PR adds resize capabilities inside the activate container. Full
device stack must be resized: PV → LV → LUKS
Steps:
1. Run pvresize and lvextend to grow the LVM layers.
2. Retrieve the LUKS key from the Ceph config-key store using the
lockbox crednetials already available in the activate container
3. Pass the key explicitly to cryptsetup resize via --key-file.
Signed-off-by: Santosh <sapillai@redhat.com>
Wire a rookLogger adapter implementing smithy's Logger
interface so that aws.LogSigning output is emitted through
rook's capnslog when debug mode is enabled.
Signed-off-by: Oded Viner <oviner@redhat.com>
Remove the AWS SDK v1 (github.com/aws/aws-sdk-go)
dependency entirely. All S3 operations now use AWS SDK v2
exclusively.
- Remove the v1 Client field from S3Agent struct and
rename ClientV2 to Client
- Remove v1 session/client initialization from NewS3Agent
- Update all call sites referencing ClientV2
- Convert integration tests to use v2 API calling
conventions (context parameter) and smithy error handling
- Remove aws-sdk-go v1.55.8 from go.mod
Signed-off-by: Oded Viner <oviner@redhat.com>
adding new tls ssl_ciphersuites supporting tls 1.3 and the existing,
ssl_cipher supports tls 1.2 and below. Adding, the docs and unit-test
changs as well.
Signed-off-by: subhamkrai <srai@redhat.com>
migrate the sns-based topic provisioner from aws-sdk-go (v1)
to aws-sdk-go-v2. replace v1 session, credentials, and
request handlers with v2 aws.Config, static credentials
provider, and endpoint resolver. convert the custom ceph rgw
v2 signer hack from a v1 handler swap to a smithy finalize
middleware. update sns api calls to use context-first
signatures, map[string]string attributes, and typed
snstypes.NotFoundException error handling via errors.As.
update unit tests accordingly.
Signed-off-by: Oded Viner <oviner@redhat.com>
User RaceFreeFakeWatcher isntead of FakeWatcher in TestAddRemoveNode
function. The test runs c.Start() in a goroutine whch stops the watcher
when done. If mockNodeOrchestrationCompeltion sends a watch ever after,
that, FakeWatcher panics with "send on a closed channel".
RaceFreeFakeWatcher safely ignores the sends on a stopped channel.
Signed-off-by: Santosh <sapillai@redhat.com>
Added a watcher in the cluster controller to detect changes to the DRBD ConfigMap used by floating monitors in TNF deployments. When the ConfigMap is updated, the watcher triggers a CephCluster reconciliation to ensure configuration changes are applied.
Fixes#17338
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
migrate the notification provisioner and s3ext packages from
aws sdk v1 to v2. the custom DeleteBucketNotification call is
rewritten to manually build and sign the HTTP request using the
v2 v4 signer, since this ceph-specific API has no sdk equivalent.
also fix t.Skipped() -> t.Skip() in notification integration test.
Signed-off-by: Oded Viner <oviner@redhat.com>
Fixes#16834 and #17384. Per-OSD CR deviceClass was ignored in
osd prepare job when reporting the osd config back to the operator,
and in the operator's reconcile override.
Fixed by resolving the per-device class from the CR devices list
in GetCephVolumeRawOSDs and in makeDeployment.
Signed-off-by: Artem Torubarov <artem.torubarov@sap.com>
this commit add option in the ceph objecstore CR
to configure TLS profile and TLS ciphersuite for
rgw beast.
Signed-off-by: subhamkrai <srai@redhat.com>
Previously, shouldFailoverMonImmediately() was called only when a mon first went out of quorum. If the node gets deleted after the timeout starts, it does not get detected until the timeout expires. Moved the call outside the timeout initialization block so it runs on every health check iteration and detects node deletion immediately.
Fixes#15953
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Going forward, admin will manage the csi operator
CR's and rook will only manage Ceph Connection cr
and client Profile cr.
The old csi driver is completely removed from Rook
and can no longer be used starting in Rook v1.20.
The upgrade guide will contain the needed transition steps
for managing the csi operator settings.
Signed-off-by: subhamkrai <srai@redhat.com>
Detect OSD encryption from the dmcrypt block path in `getOSDInfo` as a
fallback when the `encrypted` label is missing on pre-label deployments.
Include `osd.Encrypted` in the label check in `makeDeployment` so the
label reflects the actual OSD state on upgrade.
Fixes a bug where upgrading to a Rook version with the `encrypted` label
would set the label to `false` on already-encrypted OSDs, because the
label didn't exist yet and `getOSDInfo` defaulted to `false`.
Signed-off-by: Santosh <sapillai@redhat.com>
migrate bucket provisioner from aws sdk v1 to v2.
replace awserr.Error type assertions with smithy.APIError
using errors.As for v2-style error handling.
switch setBucketPolicy and setBucketLifecycle to use
the v2 s3 client (ClientV2) directly with context.
replace v1 s3 types (BucketLifecycleConfiguration,
GetBucketLifecycleConfigurationOutput) with v2 equivalents
from s3types and s3v2 packages.
add cmpopts.IgnoreUnexported to cmp.Diff calls to handle
unexported noSmithyDocumentSerde fields in v2 sdk types.
add nil guard on lifecycle output before accessing rules
to prevent nil dereference when get returns an error.
depends on #17414
Signed-off-by: Oded Viner <oviner@redhat.com>
adding missing resource request for mon drbd containers
log-collector and shut-down-app and update the unit test
to validate.
Signed-off-by: subhamkrai <srai@redhat.com>
Clean up stale CRUSH rules after the Ceph mgr starts so rules left behind by pool failure-domain or device-class changes do not accumulate indefinitely.
The cleanup is guarded by a package-level RWMutex. Pool create and update paths hold the read lock while creating and assigning CRUSH rules, while cluster-wide cleanup holds the write lock before listing pools and deleting unused rules. This keeps pool reconciles parallel with each other while preventing cleanup from deleting a rule that another reconcile has just created but not yet attached to a pool.
Keep direct pool-delete cleanup for the pool's current CRUSH rule, make the cluster-wide cleanup best-effort across all unused rules, and add an operator-level ROOK_DELETE_UNUSED_CRUSH_RULES setting for clusters that need to leave unused custom rules in place.
Document the operator and Helm settings, regenerate the Helm chart docs, and add a pending release note for the default cleanup behavior.
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
Strip unnecessary leading and trailing newlines from osdLivenessProbeScript and livenessProbeScript raw string literals in spec.go
Signed-off-by: Santosh <sapillai@redhat.com>
Ceph relaxed the stretch mode CRUSH weight check in ceph/ceph#66580 to
allow weights within 10 percent of each other. This change is available
in Ceph Umbrella and was backported to tentacle v20.2.2 via ceph/ceph
number 67790. The squid backport is still pending.
Signed-off-by: Lumir Sliva <61183145+lumir-sliva@users.noreply.github.com>
The floating mon in a TNF cluster is designed to share a node with a pinned mon. Fixed the pre-cluster start evaluation logic to allow the same when allowMultiplePerNode is set to false.
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Satoru Takeuchi
Santosh
Oded Viner
Blaine Gardner
Travis Nielsen
Joshua Hoblitt
Joshua Hoblitt
subhamkrai
Sunnatillo
Prabhala Tara Aasrita
Artem Torubarov
immanuwell
texasich
Rohan Gupta
Asish Kumar
Lumir Sliva
Parth Arora