The alert was showing wrong POD and hostname in the
alert description. Fixed the query for the same by
adding the right labels from ceph_mon_metadata query
to the original query.
Signed-off-by: Anmol Sachan <anmol13694@gmail.com>
Running integration tests locally on k8s 1.13 was causing an error
with parsing the command line flags. We can't call flags.Parse()
from an init() method.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When the tests run in a PR, they can only run against a single version
of K8s by default. If more than five k8s versions are supported in hte
CI, we will need to run some of the suites on multiple versions.
The versions are comma-separated in the list.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The host name of an OSD in the CRUSH map should be the real
host name for non-portable OSDs. It was incorrectly being set
to the PVC name. Now the non-portable OSDs based on PVCs will
corretly have the host name set to the node name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The method to construct osd environment variables is simplified
by passing a struct param instead of individual params
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In the Ceph upgrade integration test, upgrade from Rook v1.0 with Ceph
Mimic v13 to install legacy disk-based OSDs. Then upgrade Ceph to
Nautilus, then Rook to v1.1, then v1.2, then v1.3 (master currently) to
make sure that Rook is able to run legacy OSDs created without
ceph-volume.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Sometimes we fail to get logs for pods using this method, notably the
operator pod. It is unknown why this happens. Pod logs are VERY
important, so try again using kubectl.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
When configuring a cephcluster CRD on a different namespace than rook-ceph, like for example when deploying a external cluster, we need to set ROOK_CURRENT_NAMESPACE_ONLY to true so the operator can watch for CRD modifications on other namespaces.
Closes: https://github.com/rook/rook/issues/4667
Signed-off-by: Daniel Parkes <dparkes@redhat.com>
When creating a CephObjectStore object, operator will
use .Gateway.Port or .Gateway.SecurePort to create k8s
Service object, if the port is invalid, the Service
will not be created.
Note .Gateway.Port/.Gateway.SecurePort should in 1~65535,
however .Dashboard.Port is 0~65535 because 0 will use
default setting for .Dashboard.Port and there is no
such mechanism for .Gateway.Port/.Gateway.SecurePort
Closes: https://github.com/rook/rook/issues/4574
Signed-off-by: Yu Chih <secret104278@gmail.com>
currently we are running plugin container as privileged
in the provisioner pod for both cephfs and rbd.
we are also running snapshotter container as privileged
in the provisioner pod for rbd.
as we are executing the ceph and rbd commands in provisioner
pod we dont need to be privileged, This PR removed the
privileged capability from the templates.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Description of your changes:
Fix security issues identified by TrailOfBits
Modifications in osd/status.go:
I opted by remove the offending variables because "c.checkNodesCompleted"
provides this variables always, so no need to initialize them.
var was not used, so i have replaced it by the blank identifier.
Modifications in machinelabel/add.go:
I have followed the same criteria used in other disruption packages,
and return the error if it is produced when we try to "watch" machines.
Closes: https://github.com/rook/rook/issues/4565
[test ceph]
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
currently we are making use of hostpath
directory to store the provisioner socket, as this
socket is not needed by anyone else other than containers
inside the provisioner pod using empty directory
to store this socket is the best option.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
On systems with SELinux enabled, non-privileged containers
can't access data of privileged containers.
Since the socket is exposed by privileged containers,
all sidecars must be privileged too.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Current Rook code uses go dep 0.5.0 and separates handling
for Arm and x86. It's because there's no dep 0.5.0 binary
for arm64.Dep has updated to 0.5.4 and supports arm64. Rook
code can be simplified by upgrading dep to fix gaps of Arm
and x86.
Change-Id: Id91a993ca059461faa8a83065c93dadc7cdffeb2
Signed-off-by: Haichao Li <haichao.li@arm.com>
The minio operator has not had community support nor
any updates since being added to Rook. Support is being
removed from Rook due to this lack of community interest.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With the release of K8s 1.17 Rook needs to test on this new version.
The integration tests will now run the tests across K8s 1.13-1.17.
The pattern has been to run the tests across the most recent five
versions.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The retry messages are too verbose with the stack trace
since the aggregated messages were added. This change
turns off the verbose message.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
A new CRD option `continueUpgradeAfterChecksEvenIfNotHealthy` is added.
When upgrading, Rook goes OSD by OSD and then waits for PGs to be clean
before proceeding to the next OSD. Currently, Rook waits for 5 hours but
there might be circumstances where PGs need more time to settle.
Thus setting `continueUpgradeAfterChecksEvenIfNotHealthy` to true will
pursue the upgrade process, even if PGs are not 100% active+clean.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1786029
Signed-off-by: Sébastien Han <seb@redhat.com>
Add support for the k8s 1.17 official zone/region failure domain labels.
Our earlier guess that the official labels would be
<failure-domain.kubernetes.io> was wrong; the official is now
<topology.kubernetes.io>.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
The operator kit had more utility originally when the operator
was creating and managing the TPRs and CRDs directly. Since
the CRDs are now created from a manifest and no longer by the
operators, the utility of operator kit is limited to the
controller watcher. Since we are moving to the controller runtime
we simplify the code to make the transition smoother. Now
there is only a simple WatchCR method that will need to be
replaced as we maek that transition.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Replaced `math/rand` with more secure `crypto/rand` which will generate CSPRNG.
Changed the length of dashboard password from 10 to 20 and included more special characters that can strengthen password.
Passwords before this change: QoMmqLkaOf,8tqTyWF1sZ
Passwords after this change: L{QZ@_c'Rl7$uvW:UHU1, fP-OjX`UVw0J0Ka/scS(
Resolves: https://github.com/rook/rook/issues/4571
Signed-off-by: Nizamudeen <nia@redhat.com>
After a failure in a live ceph cluster, I discovered some minor glitches
when executing the instructions in ceph-disaster-recovry.md. Hopefully
this should help others.
Signed-off-by: Rik Harris <git@kawaja.net>
Sébastien Han
Travis Nielsen
Anmol Sachan
Blaine Gardner
Daniel Parkes
taeuk_kim
Yu Chih
Madhu Rajanna
Arnav Agarwal
Juan Miguel Olmo Martínez
Haichao Li
Dmitry Yusupov
Nizamudeen
Alexander Trost
Rik Harris