add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 182cd211ca)
delete csi-related directories from /var/lib/rook that
match the suffix `.csi.ceph.com`.
these folders were used in earlier versions when rook managed
cephcsi directly. in later versions, logs and data are redirected
to /var/lib/cephcsi, but legacy paths may still exist and require
cleanup during uninstall.
this change improves cleanup completeness for odf 4.18 and earlier.
example of directories removed:
- /var/lib/rook/openshift-storage.cephfs.csi.ceph.com
- /var/lib/rook/openshift-storage.rbd.csi.ceph.com
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 87165cc6d1)
This enables configuring the CrossNamespaceVolumeDataSource feature gate
Signed-off-by: CL0Pinette <me@cl0pinette.fr>
(cherry picked from commit b63c222d17)
The `CephBlockPool` CR allowed any algorithm to be specified in
`spec.erasureCoded.algorithm`, but in practice only `isa` or `jerasure`
would work.
Make that restriction explicit by restricting this field to `isa` or
`jerasure` in the CRD.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit 0b423a30f9)
When a `CephBlockPool` defines `spec.erasureCoded.algorithm`, use it as
the erasure-code-profile plugin.
Until now, that parameter would have been ignored completely, and every
erasure-coded pool would use the same plugin as the `default`
erasure-code-profile (i.e. `jerasure`).
Note that using any algorithm other than `jerasure` or `isa` is likely
to fail given the current implementation, as different algorithm require
different sets of parameters, and those cannot be supplied by the
user.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit d7f08693ed)
A typo was causing the operator to attempt to sync bucket policy when
the state was already in sync. This resulted in the operator carrying
out unnecessary work and logging activity with no user visible change
resulting.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit fbc60608ed)
Avoid the OSD startup failing to parse crush_location when
the topology label is empty.
Signed-off-by: chentao.2022 <chentao.2022@bytedance.com>
(cherry picked from commit 62631d2614)
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 79a7a3c01f)
add RecoverAndLogException() helper to log panics with stack trace.
added defer call in all rook controller Reconcile() methods for
better error visibility in operator logs
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit cf13deee6f)
This script includes bash features and will fail if sh is not a symlink to bash.
Signed-off-by: José Martínez <xose@google.com>
(cherry picked from commit e421623fd0)
fixes a nil pointer dereference in GetProbeWithDefaults when
startupProbe is set in cephfilesystem and currentProbe is nil.
adds panic recovery in cephfilesystem reconcile loop to improve
error visibility and avoid silent reconcile restarts.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 51e9ddc3f5)
Update all the go modules to the latest, except for the modules
that require go 1.24. Those modules will be updated in a
follow-up change.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 24b0b866ab)
If the node for an OSD does not exist within kubernetes, the PDB
reconciliation logic will fail to make progress. This can be problematic
as new OSDs added to the cluster may not be protected by OSD PDBs after
they are added since the PDB reconcilation logic is failing.
The solution is to treat non existing OSD nodes as drained which is
logically consistent with treating unschedulable OSD nodes as drained as
you cannot schedule a pod onto a node which does not exist.
Fixes: #16086
Signed-off-by: Elias Carter <elias@dropbox.com>
(cherry picked from commit 5f2d6c01d7)
When a mon is failed over, the old mon is left in mon quorum
until the new quorum is confirmed in quorum. When host networking
is enabled, this may result in two mons being in quorum with the
same ip, if the new mon is scheduled on the same node as the
down mon. This results in daemon crashes in the cluster since
they are confused by multiple of the same ip in the mon map.
The solution is to avoid scaling down the bad mon when host networking
is enabled. This will ensure the new mon is not scheduled on the
same node as the previous mon. With host networking, either another
node is necessary or the original mon must come back online to
restore quorum.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit aa61ddb57e)
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
(cherry picked from commit 27010f96f3)
currently, we're setting the env `DISCOVER_DAEMON_UDEV_BLACKLIST`
in operator.yaml but we're not reading from the operator env and
setting the value to discover pod env.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 2742a707cc)
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 7f3e6bd7fa)
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 5094b1f5e6)
If RemoveSecret is set remove the secret.
if not set, do below
check if the current cephClient is owner if
secret is present, if not return as its owned
by other controller, if its not present create
or update the secret.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d37297475e)
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d6d2e604fc)
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 8249a28145)
When force-deletion annotation is added to CephRadosNamespace CR, then
blocklist any watchers on the Namespace images in order to remove the
image from the trash
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 98475e847e)
The rados namespace status was not reporting if the namespace
was empty. Now the condition will be properly updated if
it is empty.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit b47f297608)
During the OSD preparation step, if the encrypted OSD disk belongs to a
different cluster, then clean the disk if `wipeDeviceFromOtherClusters`
is set to true.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 71bcdb533e)
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit dd65dc15d8)
change logger.info to logger.infof to correctly print
radosnamespace name and namespace
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 41d6baf0e1)
the status was still reading from the nil state,
updated the code to dont read from nil object
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 0b4f89873c)
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 2bcf196b15)
LeastUptodateDaemonVersion() unmarshals Ceph's daemon versions JSON
output into `map[string]<type>` maps which are not guaranteed to iterate
in the same order as output by Ceph. Fix this method to no longer assume
iteration order is the same order as Ceph's output.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit d5c4eca3fb)
currently it was using two tabs, but
others config are using one tab
So update the config to use one tag
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 58eb75b13b)
nfs short name and crd name was same
which was conflicting,
remove the short name cephnfs as it can
be already called by the crd name
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9a0490982e)
Labels cannot be longer than 64 characters, and if the image name
is too long we log a verbose message about the label that we can
just log now as debug level.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 57585ba151)
currently nfs is used as the unique selector
for daemon id, which returns nfs: ocs-storagecluster-cephnfs-a
Updating the has() to function to check the same label value
(n.Name + "-" + id)
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 79f44a4660)
this commit remove the code which sets the dmcrypt encryption
key from secret as environment variable in the prepare pod job
spec. Now, the env will be set under function `setKEKinEnv`, which
tries to reads secret from k8s first method `c.IsK8s()`under
`GetSecret` and then check for KMS to ready and apply env directly.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit d86aa28f30)
This change adds support for skipping reconciliation of CephNFS daemons
that are labeled with `ceph.rook.io/skip-reconcile=true`.
Similar to MDS, MGR, and RGW components, this allows cluster operators
to prevent Rook from modifying specific NFS daemon deployments.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 612e54e1ae)
Travis Nielsen
Oded Viner
CL0Pinette
Benoît Knecht
Joshua Hoblitt
chentao.2022
José Martínez
Madhu Rajanna
mergify[bot]
Artem Torubarov
Elias Carter
Vilius Puškunalis
subhamkrai
Patryk Rostkowski
raaizik
Muhammad Adil Ghaffar
Santosh Pillai
parth-gr
Praveen Hosamani
Blaine Gardner