rook command doesn't interpret `logtostderr` option. It's OK to just
remove this option because `capnslog` outputs all logs to stdout
by default. It's better to keep `AddGoFlagSet()` call because
some libraries might define their own flags with Go's `flag` package.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
This commit adds context parameter to k8sutil pod functions. By this, we
can handle cancellation during API call of pod resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil daemonset functions. By
this, we can handle cancellation during API call of daemonset resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil deployment functions. By
this, we can handle cancellation during API call of deployment resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
With the recent rename of master docs to the latest docs,
the links from the docs back to github need to be generated
with the latest url instead of master.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Current auth names are inadequate for a ceph cluster
serving storage to muliple Openshift clusters
Added a clusterName as a suffix on ceph auth
principals for external cluster
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1996830
Signed-off-by: parth-gr <paarora@redhat.com>
On mac, the docker build was failing due to an unspecified
S5CMD_ARCH. Now we default to build amd64 always and override
it if the arch is arm64.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The generation of the rgw deployment spec was swallowing errors
if any issues are raised such as the tls cert not being found
as expected in some configurations. We need to fail the reconcile
so the error will be logged and the admin can identify the issue.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The permissions set for ceph auth principals for
external storage are too broad, which leads to
maintenance and security risk
Modified auth principals permissions to specific pools
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1996829
Signed-off-by: parth-gr <paarora@redhat.com>
The toolbox can now interact with S3 gateways using the `s5cmd` tool.
The binary is only 12M so this does not add up too much to the operator
image size.
Closes: https://github.com/rook/rook/issues/4968
Signed-off-by: Sébastien Han <seb@redhat.com>
The cluster helm chart missed adding the default setting
for the volume expansion, so now we enable it by default.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When the configuration configmap is updated for a CephNFS server, the
NFS application should restart to ensure it is running with the latest
config.
Fixes#9028
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
When requesting issuer, we run a local kubectl proxy command which spawn
a proxy server. However, we must wait for the proxy to be ready before
we actually start making requests to it.
Now the CI waits up to 10sec to retrieve the issuer.
Closes: https://github.com/rook/rook/issues/9090
Signed-off-by: Sébastien Han <seb@redhat.com>
Adds AllowHostDirVolumePlugin to the go representation of the rook-ceph
SCC for using the hostPath. Also making it consistent with the yaml
representation.
From Openshift docs
For backwards compatibility, the usage of allowHostDirVolumePlugin overrides
settings in the volumes field. For example, if allowHostDirVolumePlugin is
set to false but allowed in the volumes field, then the hostPath
value will be removed from volumes.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
When a reconcile is started for OSDs, the prepare jobs are first
deleted from a previous reconcile. The timeout for the osd prepare
job deletion was only 40s. After that timeout, the reconcile attempts
to continue waiting for the pod, but of course will never complete
since the OSD prepare was not running in the first place, causing the
reconcile to wait indefinitely. In the reported issue, the osd prepare
jobs were actually deleted successfully, the timeout just wasn't long
enough. Pods need at least a minute to be forcefully deleted,
so we increase the timeout to 90s to give it some extra buffer.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The rook operator as well as the toolbox pod run with the "rook" user
with UID 2016. The UID was chosen based on the year of the initial
commit in the rook/rook repository.
No more root user running.
Closes: https://github.com/rook/rook/issues/8734
Signed-off-by: Sébastien Han <seb@redhat.com>
The schema has a limit of 9 data and 9 coding chunks in an EC pool.
While not typically recommended, more data chunks may be desired.
Ceph does not have a limit, so we match the behavior and also
allow any number of desired chunks to be specified.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This reverts commit c53304c3b4.
After experimenting with this release, we have found that the
`workflow_run` action source doesn't work for branches. The
documentation was updated with this PR and has more detail.
https://github.com/github/docs/pull/531
For now, we will revert back to using on.push.tags = ["v*"]
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We can pass bound_service_account_names with a comma separated list of
service accounts. Let's do this instead of remapping new values.
Earlier, we thought a single service account could be added per Vault
role and we were using other variables like
`VAULT_AUTH_KUBERNETES_ROOK_OPERATOR_ROLE` that we were remapping to
`VAULT_AUTH_KUBERNETES_ROLE` internal for the API calls to Vault.
Signed-off-by: Sébastien Han <seb@redhat.com>
In the event a ceph image is specified that is lower than the current running
version of the daemons, the downgrade is allowed, even if not technically
supported. All of the core daemons (mon,mgr,osd) were being downgraded,
but the daemons for other controllers (rgw,mds,rbdmirror) were not being
downgraded, resulting in an inconsistent cluster. Now we log that the downgrade
is not supported and all all of the daemons to be downgraded.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Satoru Takeuchi
Sébastien Han
Yuichiro Ueno
Travis Nielsen
Madhu Rajanna
parth-gr
Blaine Gardner
subhamkrai
Santosh Pillai
Yuval Lifshitz