initialize both aws sdk v1 and v2 clients in s3agent.
update createbucket to use sdk v2 while keeping all
other methods on sdk v1.
Signed-off-by: Oded Viner <oviner@redhat.com>
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
This PR creates the account root user by default when
CephObjectStoreAccount CR is created and skips it if
`spec.rootuser.skipCreate` is true.
Signed-off-by: Santosh <sapillai@redhat.com>
deleting an erasure coded CephBlockPool left the ec profile
orphaned. recreating with different settings failed because
the old profile could not be overridden.
- delete ec profile during CephBlockPool deletion
- disable --format json on ec profile set command
- fix ec profile name mismatch in CephObjectStore deletion
Signed-off-by: Oded Viner <oviner@redhat.com>
When http is disabled, the spec.status.info.insecure will keep on
showing the insecure endpoint. This PR makes sure that the
spec.status.info.insecure is empty when http is disabled
Signed-off-by: Santosh <sapillai@redhat.com>
with controller runtime latest version vO.23.0, golangci lint
is complaining about deprecated api deprecated.
This commit updates the api and adds the requried rbacs
Signed-off-by: subhamkrai <srai@redhat.com>
Update the CA bundle volume mount permissions to read-all (o444). RGW
runs as 'ceph', but the volume mount defaults to 'root'. o444 ensures
the RGW can read the bundle.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Add ceph version check to determine CA bundle configuration method.
Ceph Tentacle+ supports CURL_CA_BUNDLE environment variable, while older
versions require system CA trust update via init container.
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
This mounts custom CA bundle directly to the RGW container at
/etc/ceph/rgw-ca-bundle/ and CURL_CA_BUNDLE points to the certificate
file. Ceph changes regarding CURL_CA_BUNDLE variable is in this PR:
https://github.com/ceph/ceph/pull/44283
This change simplifies the CA bundle handling by:
- Removing the update-ca-trust init container and related volumes
- Mounting the CA bundle secret directly to the RGW pod
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
in endpoint slice for the mgr and rgw service
it was harcoded to use the ipv4,
now dynamically assign the type based on the endpoint
ip adrress type
Signed-off-by: parth-gr <partharora1010@gmail.com>
For all of the controllers besides the cluster controller,
the logging now includes the namespaced name of the resource
that is being reconciled. This will help with log troubleshooting
to help analyze logs consistently for the resource being
reconciled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
The logger names are seen on each line of logging. As
long as they are unique, they really don't need to be
long and descriptive, so let's make them a bit more
concise, and independent from controller names.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
obc was using an internal exponential backup for the lookup of the sc.
This is somewhat of an anti-pattern when using controller-runtime as it
implements retrying logic. If the sc doesn't exist, the reconcile
attempt should fail immediately and controller-runtime will handle the
back-off policy.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
A typo was causing the operator to attempt to sync bucket policy when
the state was already in sync. This resulted in the operator carrying
out unnecessary work and logging activity with no user visible change
resulting.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add RecoverAndLogException() helper to log panics with stack trace.
added defer call in all rook controller Reconcile() methods for
better error visibility in operator logs
Signed-off-by: Oded Viner <oviner@redhat.com>
This change updates the codebase to replace the deprecated
v1.Endpoints API with discoveryv1.EndpointSlice.
The v1.Endpoints API has been deprecated in Kubernetes v1.33+
Signed-off-by: subhamkrai <srai@redhat.com>
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This change cleans up and standardizes import statements across the Ceph operator code. It removes redundant or duplicate imports and reorganizes alias names for improved clarity and consistency. Additionally, the ST1019 exception was removed from .golangci.yaml now that the code complies with the rule.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
Oded Viner
majiayu000
Santosh Pillai
Artem Torubarov
Blaine Gardner
Joshua Hoblitt
subhamkrai
Sunnatillo
dependabot[bot]
Parth Arora
Travis Nielsen
SantoshPillai
cuiweixie
raaizik
Patryk Rostkowski
Carlos Barria