It has only been used by the flex driver which is long gone.
This removes the nodes/proxy RBAC grant from the helm chart, the example
YAMl and the security design docs.
Signed-off-by: Tobias Florek <me@ibotty.net>
The image pull policy was expected to be set in the cephcluster
CR or else the helm deployment would fail. Now we set the expected
default to pull if not present.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The setting for concurrent clusters is now available in the
helm chart, instead of only as an env var on the operator
deployment. reconcileConcurrentClusters will be applied to the
env var ROOK_RECONCILE_CONCURRENT_CLUSTERS.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
if admin secret is created stop creating csi secret from
the rook operator
the csi creds and secret will still be created by the python and
the import script
Signed-off-by: parth-gr <partharora1010@gmail.com>
This change mounts the rook-config-override ConfigMap in the helm chart
toolbox and merges its contents into the generated ceph.conf, matching
the behavior from commit 9570d141.
Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
The watch-active sidecar reconciles Services and wants to set
blockOwnerDeletion=true in the ownerReference. On clusters with
OwnerReferencesPermissionEnforcement admission controller this
requires the cephclusters/finalizers permission.
Signed-off-by: Manuel Grandeit <m.grandeit@gmail.com>
Since we removed the csv from rook,we don't need this tool anymore.
Let's just remove all traces of the operator SDK from Rook
Signed-off-by: subhamkrai <srai@redhat.com>
Ceph Tentacle v20 comes with erasure coding optimizations
that must be enabled explicitly with a setting on the pool.
Add this setting to the docs and examples.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
Update ScaledObject Resource to use correct metric.
ceph_rgw_put is not availabe. Using ceph_rgw_op_put_obj_ops instead.
Signed-off-by: Santosh <sapillai@redhat.com>
This commit make ceph tentacle as a default version in
cluster-test.yaml so that local and ci testing can be done
and also updating cluster.yaml to mention v20(tentacle).
Signed-off-by: subhamkrai <srai@redhat.com>
The operator supports setting options on the node exporter, such
as hostNetwork, which were previously omitted from the templated
CephCluster resource in the rook-ceph-cluster chart.
fixes: #16742
Signed-off-by: Michael Chapman <michael@aptira.com>
The activeStandby property was being ignored when deciding
how many mds daemons to start. 2x the active count of mds
daemons were always being created. If the standby is not
desired, the standby can be removed, and it was unexpected
that it was not removed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The toolbox was not respecting the rook-config-override ConfigMap,
resulting in a minimal ceph.conf with only mon_host and keyring settings.
This made it difficult to run diagnostic commands that require custom
configuration parameters.
This change mounts the rook-config-override ConfigMap in all toolbox
variants and merges its contents into the generated ceph.conf. The
merge happens after writing the base config with mon endpoints, and
is re-applied whenever mon endpoints change.
The toolbox now has consistent behavior with other Rook-managed Ceph
daemons (mon, mgr, osd, mds, rgw) which already respect config overrides.
Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
The cephcluster controller allows setting concurrent reconciles
with a setting in the operator configmap.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Standardized the quoting for variables inside the importClusterID function of import-external-cluster.sh to improve consistency
Signed-off-by: GanghyeonSeo <sgh000109@gmail.com>
Fixed a syntax error caused by incorrect quotation parsing in the importClusterID function of import-external-cluster.sh, and updated the output message shown while waiting for the SubVolumeGroup CR to be created.
Signed-off-by: GanghyeonSeo <sgh000109@gmail.com>
Add optinal hostnetwork field for Ceph Mgr to control whether the
mgr pods to run in host network. If unset, this defaults to
cluster level Network.HostNetwork value. This particulary useful
when user wants to restrict ceph mgr pod from exposing metrics
port in all host interfaces.
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
This change introduces support for setting the ceph cache memory limit
ratios that were previously hardcoded.
Codegen was drivey-by updated as the current version errored.
Resolves#16551
Signed-off-by: Tim Buchwaldt <tim.buchwaldt@deepl.com>
This fixes a regression from 51cb22c791
resulting in upgrade failure by adapting the toolbox deployment.
Signed-off-by: Daniel Höxtermann <daniel@hxtm.dev>
With the addition of the csi operator, the csi operator
image is added to the list of images that are required
for deploying rook.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add consistent metadata labels to resources that were missing them:
- configmap.yaml: Add labels to rook-ceph-operator-config ConfigMap
- securityContextConstraints.yaml: Add labels to both rook-ceph and rook-ceph-csi SCCs
- serviceaccount.yaml: Add labels to 6 CSI ServiceAccounts that were missing them
All new labels use the unified library.rook-ceph.labels template for consistency.
Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
to reflect the updated label definitions.
This addresses reviewer feedback about missing labels in non-RBAC resources
and ensures consistent labeling across all Rook Ceph Helm chart resources.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The current behavior does not print the PHASE column, as most other
CRDs do. E.g.:
```
~ $ k get cephnfs nfs1
NAME AGE
nfs1 45d
```
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The current behavior does not print the PHASE column, as most other
CRDs do. E.g.:
```
~ $ k get cephbn chorus
NAME AGE
chorus 10d
```
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The current behavior does not print the PHASE column, as most other
CRDs do. E.g.:
```
~ $ k get cephor lfa
NAME AGE
lfa 45d
```
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The image repo and tag conveniently can be specified separately
so the release tag can be picked from the official chart, and
the repo can be customized in the values.yaml
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Joshua Hoblitt
Tobias Florek
Travis Nielsen
Oded Viner
Praveen M
Parth Arora
dependabot[bot]
Matthew N. Heler
Manuel Grandeit
subhamkrai
Artem Torubarov
Santosh
Michael Chapman
fancl20
GanghyeonSeo
Sunnatillo
Blaine Gardner
Daniel Höxtermann
Tim Buchwaldt
Madhu Rajanna
fullstackjam
Erik Sundell