Rotate fs mirror daemon cephx keys based on the cephXconfig in the
cephcluster spec and also update the fs mirror status with the latest
cephxStatus
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 8df6b8d0d0)
The CSI operator requires the SecurityContextConstraints to
be configured for the service accounts that have a different
name from the previous CSI driver, both via the manifest install
and the helm install.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit cb6da09a44)
rotate mon daemon keys and update the cephx status for mons in the
cephcluster resource.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit fe42fe102f)
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit ee6f2e654a)
updating the csi operator API version
to latest version.
Adding the cephFS and RBD controllerPublish
secret that are required for the fencing
operation that is supported by ceph-csi
with csi-operator.
Updated the storageclass to include the
secrets incase if user wants to override
the defaults in the clientProfile for
new PVC's.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 3d024ce3c7)
this yaml contains all the rbac, crds and csi-operator
deployment all-in-one.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 850ef60a31)
csi never used adminID and adminKey for the
rbd secrets, This currently looks to be a
bug where we are creating the secret with userID
and userKey but updating it with adminID and
adminKey, This commits update the script to
use userID and userKey for RBD secrets.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit db44ef3645)
cephCSI already deprecated the adminID and
adminKey keys in the secrets and to be backward
compatible it still supports the adminID and
adminKey but it logs the warning, updating the
secrets created by Rook to use userID and userKey
instead of adminID and adminKey.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit cb89f351ed)
rotate the client.rbd-mirror-peer key based on the cephxconfig.
Also update the cephxStatus in the cephcluster as well as the
mirrored cephblockpool.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit ee0b137d75)
rotate RBD mirror daemon keys, add secret resource version to the mirror
deployment and update the mirror resource status after the key is
rotated
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit d0fbf6c424)
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 182cd211ca)
This enables configuring the CrossNamespaceVolumeDataSource feature gate
Signed-off-by: CL0Pinette <me@cl0pinette.fr>
(cherry picked from commit b63c222d17)
The `CephBlockPool` CR allowed any algorithm to be specified in
`spec.erasureCoded.algorithm`, but in practice only `isa` or `jerasure`
would work.
Make that restriction explicit by restricting this field to `isa` or
`jerasure` in the CRD.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit 0b423a30f9)
rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the ceph exporter daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9ec7a767c3)
Implement automated CephX key rotation for OSDs.
OSDs have marshalled CephX statuses applied as an annotation on the OSD
pod spec, which differs from other Rook Ceph daemons for a two reasons:
A large cluster could have hundreds or thousands of OSDs, so it is more
critical that Rook avoid rotating OSD keys more than once in the event a
CephCluster reconcile restarts partway through OSD creation/updation.
OSDs do not have their CephX keys stored in K8s Secrets, whose resource
version is used for enforcing the desired restart behavior other daemon
pods like RGWs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 4189a196c1)
rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the crashcollector
daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the new squid patch release, update the base
image, the docs, and the examples to all use the latest
stable Ceph release v19.2.3.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the subvolume group.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the radosnamespace.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This PR implements the CSI cephx key rotation feature,
which follows overlapping rotation for non-daemon keys.
Refer to the cephx rotation API from design PR 15915 for details.
Signed-off-by: subhamkrai <srai@redhat.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a new flag `--cephx-key-rotate` to rotate the
cephx keys genrated by external python script,
If we enable it, it will create a new user with suffix `.{x}`
Signed-off-by: parth-gr <partharora1010@gmail.com>
Rotate cephx keys for all the MDS daemons based on the cephxConfig in
teh cephCluster CR. Update the cephxStatus in the cephCluster CR and
cephfileSystem CR.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
The rook-ceph SecurityContextConstraints in the rook-ceph helm chart does not include all the users necessary for a successful deployment. Specifically, rook-ceph-default, rook-ceph-mgr, rook-ceph-osd, and rook-ceph-rgw are listed in the operator-openshift.yaml example file (https://github.com/rook/rook/blob/master/deploy/examples/operator-openshift.yaml) but are not included in the helm chart. This commit adds these users.
Signed-off-by: Mason Buchanan <masonwb@gmail.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a cephclient api support to rotate the
cephx keys genrated by cephclient
Signed-off-by: parth-gr <partharora1010@gmail.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Praveen M
Santosh Pillai
Travis Nielsen
subhamkrai
Madhu Rajanna
mergify[bot]
Niels de Vos
Oded Viner
CL0Pinette
Benoît Knecht
parth-gr
Blaine Gardner
Michael Adam
Steve Wills
subham rai
Mason
synthe102