The operator settings loaded from the configmap have proven
inefficient for load time and frequently checking the configmap.
To avoid this ineffenciency, the configmap is only loaded once
each time it is created or updated. The values in the configmap
are applied as environment variables, which then are very efficient
to query throughout the various controllers, without needing
to be concerned about loading the configmap again.
Co-authored-by: Dmitry Mishin <dmitry.mishin@gmail.com>
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit d109dc9029)
The Kubernetes CSI sidecars have had several releases that were not
included in deployments by Rook yet, update them to the versions that
are available today:
- csi-node-driver-registrar:v2.13.0
- csi-provisioner:v5.1.0
- csi-attacher:v4.8.0
- csi-resizer:v1.13.1
Signed-off-by: Niels de Vos <ndevos@ibm.com>
(cherry picked from commit 955fa9cae4)
The operator namespace is where the csi driver resources
are being created. The prefix is expected to match the
namespace where the driver is being created.
It was an incorrect change from 15245 where it
had been assumed that the cluster prefix name was
required instead.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit f9ebaf3418)
When the cluster is in a different namespace from the rook
operator, the csi provider name was setting the incorrect
namespace prefix. Now the prefix will be the same as the
ceph cluster namespace.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit ac1767fa0f)
With the updated dependencies, the csi unit tests
require new default fields in the comparison of the
json test blob.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 2fdf173ddf)
The ci was using a pretty old version og golangci-lint.
This updates to the latest version.
Additionally, it silences some
gosec integer conversion overflow false positves
and fixes some real errors of this category
and string format errors found by golangci-lint, while at it.
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit df511fb58f)
cephcsi 3.13.0 is released today and
update the Rook to use the latest image
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 07f5700a87)
In the Alpha Version of the VolumeGroupSnapshot
Feature the flag to enable the feature was
`--enable-volume-group-snapshots=true` and in the beta
API the feature is diasbled by default to enable it
we need to set `--feature-gate=CSIVolumeGroupSnapshot=true`
There is a change in the flag between the API version
This PR add a code where we choose the required
flag based on the API version.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 279e5f7cac)
cephcsi fixed a bug related to data loss
and its fixed in 3.12.3 release, This commit
updates the cephcsi to 3.12.3 release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
this commit fix the code error faced during e2e testing in
different PR. This PR is just subset of PR 14766. We don't want
to include CI changes in this PR yet.
Signed-off-by: subhamkrai <srai@redhat.com>
Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.
5.2.8 Minimize the admission of containers with added capabilities
Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
The version checks for the csi driver are removed now
since they are all obsolete. The K8s version and cephcsi
versions are no longer checked. Anyway, the move to the
csi operator would take ownership of version checks
needed in the future, so for now we simplify rook
deployment of the csi driver.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.
5.7.3 Apply Security Context to Your Pods and Containers
When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
deployments on openshift where we need csi container pods
to be run on privileged, the logrotate sidecar container was missing the
privileged permission letting, side car to not run properly
Signed-off-by: parth-gr <partharora1010@gmail.com>
to keep it simple we'll not delete the csi-operator resources
we'll only document this for users who want to switch to csi-drivers.
Anyways by next release we'll only support csi-operator only.
Signed-off-by: subhamkrai <srai@redhat.com>
This new setting is of Boolean type and defaults to "false".
When set to "true", it changes the behavior of the
rook operator to
nable host network on all pods created by the cephcluster controller
new method to check the setting: opcontroller.EnForceHostNetwork()
Signed-off-by: Michael Adam <obnox@samba.org>
updating csi-operator version in go.mod and csi-operator.yaml
to use latest release v0.1. And also fixing one small bug
where csi-driver log level was set in csi-operator log level.
Signed-off-by: subhamkrai <srai@redhat.com>
The jobs to detect the ceph and csi versions now can have
custom annotationso and labels added to them. They are
very short-lived jobs, but they may need custom annotations
in some environments to run.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
adding annotation to existing CSI driver resource so that
csi-operator can take ownership of existing CSI driver resources.
Signed-off-by: subhamkrai <srai@redhat.com>
adding code changes,rbac changes required for create the new
Ceph-CSI operator CR named cephCluster in api group 'csi.ceph.io'.
Signed-off-by: subhamkrai <srai@redhat.com>
issue:
external-provisioner (v5) enabled topology feature-gate by default
and the current implementation in Rook uses a conditional block to
enable the topology feature gate. This approach now does not directly
reflect the state of the `CSI_ENABLE_TOPOLOGY`.
fix:
replacing the conditional block with a direct use of the
`CSI_ENABLE_TOPOLOGY` for flag value.
Signed-off-by: Praveen M <m.praveen@ibm.com>
This commit adds the flexibility to configure kube apiserver qps
as per the user requirement and also keeps the existing values as
the default one.
Signed-off-by: yite.gu <yitegu0@gmail.com>
Use the same logrotate flow of rbd, as merged in #14305
1) Make the csi cephfs and nfs container logs persisted in a file
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
And some fixes on the implementation:
1) Add a operator namespace in the log file path
2) Only add volume to the container if logrotate is enabled
Closes: https://github.com/rook/rook/issues/12809, https://github.com/rook/rook/issues/14429
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the recent enhancements csi containers for using
logrotate, they need to run with securityContext to privileged,
on platform like openshift.
Used the ROOK_HOSTPATH_REQUIRES_PRIVILEGED flag
wich is set with operator deployment to see
if the securityCOntext is needed or not
Closes: https://github.com/rook/rook/issues/14400
Signed-off-by: parth-gr <partharora1010@gmail.com>
yati1998
Travis Nielsen
Skala Networks
Artem Torubarov
Niels de Vos
Steven Kreitzer
Michael Adam
Madhu Rajanna
subhamkrai
Peter Razumovsky
Blaine Gardner
parth-gr
parth-gr
Praveen M
chanyoung
yite.gu