If multiple removal jobs are fired in parallel, there is a risk of
losing data since we will forcefully remove the OSD. It's also simply
true if a single OSD is not safe to destroy, there is also a risk of
data loss.
So now, we check if the OSD is safe-to-destroy first and then proceed.
The code waits forever and retries every minute unless the
--force-osd-removal flag is passed.
Signed-off-by: Sébastien Han <seb@redhat.com>
In the nightly job, run the test with the latest Ceph version so we can
detect if there are RGW changes in Ceph that might break multisite. Use
a reusable GitHub action workflow to duplicate as little code as
possible.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
From ceph v16.2.6 onwards the vault TLS suppport in RGW was added,
include similar changes for RGW.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
When requesting issuer, we run a local kubectl proxy command which spawn
a proxy server. However, we must wait for the proxy to be ready before
we actually start making requests to it.
Now the CI waits up to 10sec to retrieve the issuer.
Closes: https://github.com/rook/rook/issues/9090
Signed-off-by: Sébastien Han <seb@redhat.com>
The rook operator as well as the toolbox pod run with the "rook" user
with UID 2016. The UID was chosen based on the year of the initial
commit in the rook/rook repository.
No more root user running.
Closes: https://github.com/rook/rook/issues/8734
Signed-off-by: Sébastien Han <seb@redhat.com>
rgw doesn't respond `livenessProbe` if the number of connection reaches its
limit (by default, 1000). Then rgw is out of service but still live.
Hense the current `livenessProbe` logic is suitiable for `readinessProbe`.
`tcpSocket` is enough for `livenessProbe`.
Closes: #8407
Signed-off-by: Yuzuki Mimura <yuzuki725.m@gmail.com>
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
The deployment of the OSD is already confirmed at the end of
`deploy first cluster rook' step.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Rook cluster-wide encryption can now use the native Kubernetes
authentication to interact with vault KMS instead of using the token
method.
Signed-off-by: Sébastien Han <seb@redhat.com>
When we copy the peer token secret from a namespace to another we also
copy the ownerref, however the creation succeeds but the controller
removes the secret since the uid of the owner do not exist in that
namespace.
Signed-off-by: Sébastien Han <seb@redhat.com>
Add some commands to get more partition info when setting up the GH
action runner's disk for use in integration tests. This will both aid in
debugging and may "jog" the system such that it will no longer need to
reload the partition info when running the OSD prepare job.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The `head` command exits once it has output which can result in a
SIGPIPE error if the command piping its output to head hasn't yet
finished. Use `awk 'FNR <= 1'` instead, which waits on the input pipe to
close before it exits.
See here for more info:
https://unix.stackexchange.com/a/256047
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The Filesystem is deployed later in the run so at this point we only
need to validate the OSDs are running. This was failing since we were
validating the cephfs pool which is not present yet.
Signed-off-by: Sébastien Han <seb@redhat.com>
Add to the RGW multisite integration test a verification that the RGW
period is committed on the first reconcile and not committed on the
second reconcile.
Do this in the multisite test so that we verify that this works for
both the primary and secondary multi-site cluster.
To add this test, the github-action-helper.sh script had to be modified
to
1. actually deploy the version of Rook under test
2. adjust how functions are called to not lose the `-e` in a subshell
3. fix wait_for_prepare_pod helper that had a failure in the middle
of its operation that didn't cause failures in the past
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The canary tests were still picking up the tag from operator.yaml
and toolbox.yaml instead of the new test local-build tag.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 6f48dce3f5)
run tmate only for `pull_request` event and
remove for other events. As during release
when tests fail it takes extra 30 min to fail the
test or someone manually has to end the test
which is painfully especially during release time.
Signed-off-by: subhamkrai <srai@redhat.com>
The new version v16.2.6 has a different behavior when it comes to the
number of cephfs-mirror socket files. Previous version had exactly 3 and
now has like way more...
So let's just check for the presence of more sockets.
Signed-off-by: Sébastien Han <seb@redhat.com>
We should not use .items[0].metadata.name if the array length is 0. This
is the case when nothing has been initialized yet. Instead, we should
use .items[*].metadata.name, the wildcard ensures to always return 0
even if nothing is present yet.
Fixes: https://github.com/rook/rook/issues/8676
Signed-off-by: Sébastien Han <seb@redhat.com>
During disaster recovery/migration of a cluster, as part of the failover, the
kubernetes artifacts like deployment, PVC, PV, etc will be restored to a new
cluster by the admin. Even if the kubernetes objects are restored the
corresponding RBD/CephFS subvolume cannot be retrieved during CSI operations as
the clusterID and poolID are not the same in both clusters
This PR creates a mapping between Cluster ID and RBD Pool ID between
local cluster and peer cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
This test:
- starts up 2 minikube clusters
- create 2 ceph clusters
- creates object multisite CRDs on each cluster and
syncs the clusters
- writes an object to cluster 1 and reads it on
cluster 2
This commit also adds new functions in
github-action-helper.sh that aid in the multisite
test and the multi cluster mirroring test.
Signed-off-by: Ali Maredia <amaredia@redhat.com>
They are scenarios where the mirroring information want to be shared
between clusters prior to creating pool. Because the bootstrap peer
import command needs a pool name to operate this is not suitable. So
additionally now each time the cluster is reconciled and on any new
clusters a new secret will be created that contains a boostrap peer
token. It can be exchanged with another cluster.
Signed-off-by: Sébastien Han <seb@redhat.com>
The CI test for mirroring now runs on stable v16 tag. Internally our
code has a minimum version of 16.2.5 for cephfs mirroring since it's
available.
Signed-off-by: Sébastien Han <seb@redhat.com>
Rook will now auto detect the kv version of the vault server. This
allows users not having to pass the VAULT_BACKEND configuration in the
CephCluster CR.
Signed-off-by: Sébastien Han <seb@redhat.com>
The build version should be detected with the git describe
command, but if the VERSION var is already set, it will be
used instead of being detected from git. During the official
builds or even local builds, we just want to let the makefile
detect the git version.
The full git history is added to enable proper detection of the
version. Without the full history only a hash is returned for
the version, which then results in an invalid semantic version
error for the helm chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Instead of having the RBDMirroringPeerSpec in the RBDMirror CRD we want
to move it on the CephBlockPool CRD so that each pool can have its own peer.
This enables pool to re-use an existing peer secret if it points to the
same cluster peer.So we don't need to duplicate secret peer anymore.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Similarly to block volume replication, Ceph is capable of replicating the
content of a Ceph Filesystem from one cluster to another.
For this, during the 1.6 cycle, we introduced a new CRD called
CephFilesystemMirror which effectively deploys a cephfs-mirror daemon.
However, configuring peers to enable replication between two clusters
had to be done manually.
Also various bug fix made it in Ceph eventually and the minimum required
version for this to work is to run on Ceph Pacific 16.2.5 at least.
So the automatic configuration of Ceph Filesystem peers is now possible.
By editing the CephFilesystem CRD, you can now turn on mirroring:
```yaml
mirroring:
enabled: false
# list of Kubernetes Secrets containing the peer token
# for more details see: https://docs.ceph.com/en/latest/dev/cephfs-mirroring/#bootstrap-peers
peers:
secretNames:
- secondary-cluster-peer
```
Also, the mirroring status is displayed in the CR status:
```
status:
info:
fsMirrorBootstrapPeerSecretName: fs-peer-token-myfs
mirroringStatus:
daemonsStatus:
- daemon_id: 4186
filesystems:
- filesystem_id: 2
name: myfs
lastChecked: "2021-07-01T14:16:29Z"
phase: Ready
snapshotScheduleStatus:
lastChecked: "2021-07-01T14:16:29Z"
snapshotSchedules:
- fs: myfs
path: /
rel_path: /
retention: {}
schedule: 24h
```
Closes: https://github.com/rook/rook/issues/7063
Signed-off-by: Sébastien Han <seb@redhat.com>
For all Rook-maintained GH actions, use a default shell that has xtrace
enabled to help debug any errors.
Enable xtrace on all actions except these that use only external tools:
- codespell
- commitlint (wagoid/commitlint)
- golangci-lint
- helm-lint (chart-testing)
- stale
- yamllint
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We still see the CI failing with:
```
Traceback (most recent call last):
File "/etc/ceph/create-external-cluster-resources.py", line 801, in <module>
raise err
File "/etc/ceph/create-external-cluster-resources.py", line 798, in <module>
rjObj.main()
File "/etc/ceph/create-external-cluster-resources.py", line 779, in main
generated_output = self.gen_json_out()
File "/etc/ceph/create-external-cluster-resources.py", line 613, in gen_json_out
self._gen_output_map()
File "/etc/ceph/create-external-cluster-resources.py", line 598, in _gen_output_map
self.out_map['MONITORING_ENDPOINT_PORT'] = self.get_active_and_standby_mgrs()
File "/etc/ceph/create-external-cluster-resources.py", line 389, in get_active_and_standby_mgrs
self.endpoint_dial(monitoring_endpoint)
File "/etc/ceph/create-external-cluster-resources.py", line 245, in endpoint_dial
"unable to connect to endpoint: {}".format(endpoint_str))
__main__.ExecutionFailureException: unable to connect to endpoint: 172.17.0.7:9283
command terminated with exit code 1
```
Signed-off-by: Sébastien Han <seb@redhat.com>
Before running the external script test let's make sure the prometheus
exporter is loaded. We often see in the CI errors like:
```
kubectl -n rook-ceph exec $(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[0].metadata.name}') -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool
shell: /bin/bash -e {0}
env:
GOROOT: /opt/hostedtoolcache/go/1.16.4/x64
MINIKUBE_HOME: /home/runner/work/_temp
Execution Failed: unable to connect to endpoint: 172.17.0.10:9283
Traceback (most recent call last):
File "/etc/ceph/create-external-cluster-resources.py", line 801, in <module>
raise err
File "/etc/ceph/create-external-cluster-resources.py", line 798, in <module>
rjObj.main()
File "/etc/ceph/create-external-cluster-resources.py", line 779, in main
generated_output = self.gen_json_out()
File "/etc/ceph/create-external-cluster-resources.py", line 613, in gen_json_out
self._gen_output_map()
File "/etc/ceph/create-external-cluster-resources.py", line 598, in _gen_output_map
self.out_map['MONITORING_ENDPOINT_PORT'] = self.get_active_and_standby_mgrs()
File "/etc/ceph/create-external-cluster-resources.py", line 389, in get_active_and_standby_mgrs
self.endpoint_dial(monitoring_endpoint)
File "/etc/ceph/create-external-cluster-resources.py", line 245, in endpoint_dial
"unable to connect to endpoint: {}".format(endpoint_str))
__main__.ExecutionFailureException: unable to connect to endpoint: 172.17.0.10:9283
command terminated with exit code 1
```
but then when we log into the runner, we can see the command works.
So let's wait a little bit for the module to be up.
Signed-off-by: Sébastien Han <seb@redhat.com>
RGW supports only v2 version of kv engine, current integration test is written for kv v1,
hence seperating existing test into two.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
we have lots of duplicate codes for
github action. this commit refactor
them to a bash script which will minimize
duplicate codes.
Signed-off-by: subhamkrai <srai@redhat.com>
30sec was not enough see:
```
# let's wait a bit for the image to be present
timeout 30 sh -c 'until [ "$(kubectl exec -n rook-ceph-secondary deploy/rook-ceph-tools -t -- rbd -p replicapool ls|grep -c test)" -eq 1 ]; do echo "waiting for image to be mirrored" && sleep 1; done'
shell: /bin/bash -e {0}
env:
GOROOT: /opt/hostedtoolcache/go/1.16.3/x64
MINIKUBE_HOME: /home/runner/work/_temp
unable to get monitor info from DNS SRV with service name: ceph-mon
rbd: couldn't connect to the cluster!
rbd: listing images failed: (2) No such file or directory
2021-04-22T08:17:47.053+0000 7f824b13e2c0 -1 failed for service _ceph-mon._tcp
2021-04-22T08:17:47.053+0000 7f824b13e2c0 -1 monclient: get_monmap_and_config cannot identify monitors to contact
command terminated with exit code 2
waiting for image to be mirrored
unable to get monitor info from DNS SRV with service name: ceph-mon
rbd: couldn't connect to the cluster!
rbd: listing images failed: (2) No such file or directory
2021-04-22T08:17:48.317+0000 7f31f6d372c0 -1 failed for service _ceph-mon._tcp
2021-04-22T08:17:48.317+0000 7f31f6d372c0 -1 monclient: get_monmap_and_config cannot identify monitors to contact
command terminated with exit code 2
waiting for image to be mirrored
unable to get monitor info from DNS SRV with service name: ceph-mon
rbd: couldn't connect to the cluster!
rbd: listing images failed: (2) No such file or directory
2021-04-22T08:17:49.597+0000 7fa3a2ac52c0 -1 failed for service _ceph-mon._tcp
2021-04-22T08:17:49.597+0000 7fa3a2ac52c0 -1 monclient: get_monmap_and_config cannot identify monitors to contact
command terminated with exit code 2
waiting for image to be mirrored
unable to get monitor info from DNS SRV with service name: ceph-mon
rbd: couldn't connect to the cluster!
rbd: listing images failed: (2) No such file or directory
2021-04-22T08:17:50.873+0000 7fab17fb12c0 -1 failed for service _ceph-mon._tcp
2021-04-22T08:17:50.873+0000 7fab17fb12c0 -1 monclient: get_monmap_and_config cannot identify monitors to contact
command terminated with exit code 2
waiting for image to be mirrored
unable to get monitor info from DNS SRV with service name: ceph-mon
rbd: couldn't connect to the cluster!
rbd: listing images failed: (2) No such file or directory
2021-04-22T08:17:52.169+0000 7f944f52f2c0 -1 failed for service _ceph-mon._tcp
2021-04-22T08:17:52.169+0000 7f944f52f2c0 -1 monclient: get_monmap_and_config cannot identify monitors to contact
command terminated with exit code 2
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
waiting for image to be mirrored
Error: Process completed with exit code 124.
```
However, when logging into the runner, the image was replicated.
Signed-off-by: Sébastien Han <seb@redhat.com>
Sébastien Han
Blaine Gardner
Jiffin Tony Thottan
subhamkrai
Yuzuki Mimura
Satoru Takeuchi
Travis Nielsen
Santosh Pillai
Ali Maredia