Update the CA bundle volume mount permissions to read-all (o444). RGW
runs as 'ceph', but the volume mount defaults to 'root'. o444 ensures
the RGW can read the bundle.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The do-not-reconcile label on the mon deployments was
causing the mon reconcile to be skipped for all mons,
even if the label was only on a single mon. Now, the
skipping of reconcile will only be scoped to a single
mon.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add ceph version check to determine CA bundle configuration method.
Ceph Tentacle+ supports CURL_CA_BUNDLE environment variable, while older
versions require system CA trust update via init container.
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
This mounts custom CA bundle directly to the RGW container at
/etc/ceph/rgw-ca-bundle/ and CURL_CA_BUNDLE points to the certificate
file. Ceph changes regarding CURL_CA_BUNDLE variable is in this PR:
https://github.com/ceph/ceph/pull/44283
This change simplifies the CA bundle handling by:
- Removing the update-ca-trust init container and related volumes
- Mounting the CA bundle secret directly to the RGW pod
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
Read affinity in Ceph v20.2.0 can cause corruption.
Disable this feature for this version of Ceph to
avoid hitting any corruption in this case. When the next
patch release is out for tentacle, this issue will be
resolved and when upgrading to it, read affinity would
automatically be re-enabled if needed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
if admin secret is created stop creating csi secret from
the rook operator
the csi creds and secret will still be created by the python and
the import script
Signed-off-by: parth-gr <partharora1010@gmail.com>
add support for ceph.rook.io/do-not-reconcile on cephcluster crs
skip reconcile early and emit a normal reconcile-skipped event
avoid reloadmanager on updates for labeled cephclusters
add unit test for skip behavior
Signed-off-by: Oded Viner <oviner@redhat.com>
The udev is required for cleanup in both host-based clusters
and pvc-based clusters since the tentacle release.
The cleanup jobs were failing in pvc-based clusters
with tentacle where we skipped adding the udev mount.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
previously, if multiple mount option was passed it was
handing it wrong. For example,
```
ms_mode=prefer-secure,recover_session=clean
```
was treated as
```
ms_mode: prefer-secure,recover_sessio
```
With current fix it handles it correctly. Example,
```
ms_mode: prefer-secure,
recover_session=clean,
```
Signed-off-by: subhamkrai <srai@redhat.com>
in endpoint slice for the mgr and rgw service
it was harcoded to use the ipv4,
now dynamically assign the type based on the endpoint
ip adrress type
Signed-off-by: parth-gr <partharora1010@gmail.com>
For all of the controllers besides the cluster controller,
the logging now includes the namespaced name of the resource
that is being reconciled. This will help with log troubleshooting
to help analyze logs consistently for the resource being
reconciled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
Add a resource watch to reconcile clusters when any referenced Secrets
in cephConfigFromSecret are updated. This matches the behaviour of
reconciling clusters when cephConfig changes. Without this change, if a
Secret that is referenced by cephConfigFromSecret is updated, then the
cluster is not immediately updated, so the cluster state will not match
the configuration until something else triggers a reconcile.
Resolves#16371
Signed-off-by: Martin Rowe <martin.p.rowe@gmail.com>
The logger names are seen on each line of logging. As
long as they are unique, they really don't need to be
long and descriptive, so let's make them a bit more
concise, and independent from controller names.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When writing to the operator log, where possible
the namespace of the resource on which the operator
is working will be logged as a standard prefix
to more easily troubleshoot what resource is being reconciled
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The activeStandby property was being ignored when deciding
how many mds daemons to start. 2x the active count of mds
daemons were always being created. If the standby is not
desired, the standby can be removed, and it was unexpected
that it was not removed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Use a sync map for the clusterMap in the cluster controller
and fix other issues to allow for concurrent cluster
reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cephcluster controller allows setting concurrent reconciles
with a setting in the operator configmap.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
currently, in SVG crd while updating status we don't have retryOnConflicts
similar to other CRD, this commit add the retryOnConflicts.
Signed-off-by: subhamkrai <srai@redhat.com>
In a running cluster, I noticed that a node which was provisioning was removed from k8s
and the following log was emitted by the rook operator:
```
op-osd: cleaning up dangling OSD prepare status configmap "rook-ceph-osd-xxx-status"
```
But the osd provisioning job was still trying to run on the removed node:
```
rook-ceph-osd-prepare-xxx Running 0/1 4d22h 4d22h
```
This PR implements a mechanism to remove any osd provision jobs which are bound to a
node which no longer exists within kubernetes. I added a test for this cleanup as
there wasn't a pre-existing test.
Signed-off-by: Elias Carter <elias@dropbox.com>
if the filesystem is just created and getting the status
updated svg controller can still go and proceed to
check the filesystem status
If the filesystem status is empty we should retry instead of
proceeding further
Signed-off-by: parth-gr <partharora1010@gmail.com>
if the pool is just created and getting the status
updated rn controller can still go and proceed to
check the pool status
If the pool status is empty we should retry instead of
proceeding further
Signed-off-by: parth-gr <partharora1010@gmail.com>
currently, in RNS crd while updating status we don't
have retryOnConflicts, similar to other CRD due to
this RNS status was not updated succesfully and to
fix this we have restart the rook operator pod.
Signed-off-by: subhamkrai <srai@redhat.com>
currently the device class label was added to the osd pod,
we need the device class label on prepare pod,
so to spread across prpeare pods evenly among the faiure domains
per device class
Signed-off-by: parth-gr <partharora1010@gmail.com>
Joshua Hoblitt
Blaine Gardner
Travis Nielsen
Oded Viner
Praveen M
Sunnatillo
Parth Arora
dependabot[bot]
Jongwoo Han
subhamkrai
Martin Rowe
Steve Wills
Elias Carter
subham rai
huyejia