The topology spread constraint example allowed scheduling even
if the TSC could not be satisfied when scheduling the osd prepare
jobs. This could lead to unevenly spread OSDs especially when
the cluster was not using the zone labels. Now the topology will be
required for scheduling, to ensure proper spread of the OSDs.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In pkg/operator/k8sutil/network.go:ApplyMultus(), be more explicit about
the intended behavior in both var names, code comments, and unit tests.
Additionally fix a logic bug that could cause errors in the future if
more "cluster network apps" are identified in the future.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We know append additional information to the rbd-mirror bootstrap peer
token. It is useful for disaster recovery scenario where the other
cluster is reading the peer token and needs to know the pool_id as well
as the namespace.
Signed-off-by: Sébastien Han <seb@redhat.com>
In a production cluster we never should have two mons running on
the same node. However, if two mons have ended up on the same node,
whether from a bug or some other unintentional event, the operator
will evict one of them and failover to a new mon. This only applies
when allowMultiplePerNode is false.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For all Rook-maintained GH actions, use a default shell that has xtrace
enabled to help debug any errors.
Enable xtrace on all actions except these that use only external tools:
- codespell
- commitlint (wagoid/commitlint)
- golangci-lint
- helm-lint (chart-testing)
- stale
- yamllint
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The operator has very bursty behavior while it is reconciling, then
has much lower resource requirements. We reduce the memory requests to 128Mi
while the limits remain at 256Mi. When not reconciling, the background
health operations are much less resource demanding.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In e8f9cfcb71, the logging was replaced by
Debug which is probably a mistake given the intent of the commit to
enable debug logging on the prepare job.
However, this code is only triggered when running a ceph-osd with the
rook binary, so we must run Info and run Debug since Debug is not
activated.
Signed-off-by: Sébastien Han <seb@redhat.com>
When evaluating the potential "warning" key from the json output we were
not hiding stdout (1) from the output, so the key was leaked. Also the
warning check for the key was not perfect, it only checked for the
command to succeed, but we should introspect it since the "warning" key
is always present unlike the "error" one.
We now only print the warning or the error is present.
Signed-off-by: Sébastien Han <seb@redhat.com>
In pkg/operator/k8sutil/network.go:ApplyMultus(), sort the string
annotations before applying them so that Rook will avoid the situation
where a Deployment or Pod will need updated repeatedly even when no
Multus network configuration has changed.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We have seen issues with fullchain.pem files containing one self-signed
certificate. At the same time, the failing configuration was not
providing any client certificates or keys.
The error from curl was `"self signed certificate in the chain"`.
The openssl binary is not available so we cannot even c_rehash the
certificate directory when using `--capath`, however this worked already
with a fully signed fullchain.pem along with a client certificate and
key. So we cannot only use `--cacert` which will break that use case.
This is becoming really obscur on why using `--cacert` solves this
problem. I just can't wait to use the `vault` binary, that's all I can
say...
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit moves SetParams and ValidateCSIParam func
into go routine/lock, since it modifies/reads global CSIParam
variable.
Signed-off-by: Rakshith R <rar@redhat.com>
For the TLS communication for AdminOps Api, httpclient is required and
filled with TLS certs, currently it is set to nil pointer in
`buckethealthchecker` and `cephobjectstoreuser`.
Thanks @Krast76 finding the issue even proposing the fix.
Fixes: #8132
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
When the mons are using the dataDirHostPath and not a volumeClaimTemplate,
they need to be permanently assigned to a node. The node assignment
was missing in stretch clusters when the dataDirHostPath was being
used. This resulted in mons that were moving to other nodes for example
during a node drain, which would cause the mon to lose its backing store.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Move MDS related information from the Cluster to the Filesystem document.
Document how resource requests influence Ceph configuration keys.
Signed-off-by: Pedro Lopes <paol@draic.org>
Travis Nielsen
Sébastien Han
subhamkrai
Rakshith R
Blaine Gardner
Blaine Gardner
Andy Bursavich
Jiffin Tony Thottan
Pedro Lopes