rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the ceph exporter daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9ec7a767c3)
Implement automated CephX key rotation for OSDs.
OSDs have marshalled CephX statuses applied as an annotation on the OSD
pod spec, which differs from other Rook Ceph daemons for a two reasons:
A large cluster could have hundreds or thousands of OSDs, so it is more
critical that Rook avoid rotating OSD keys more than once in the event a
CephCluster reconcile restarts partway through OSD creation/updation.
OSDs do not have their CephX keys stored in K8s Secrets, whose resource
version is used for enforcing the desired restart behavior other daemon
pods like RGWs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 4189a196c1)
rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the crashcollector
daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the new squid patch release, update the base
image, the docs, and the examples to all use the latest
stable Ceph release v19.2.3.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the subvolume group.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the radosnamespace.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This PR implements the CSI cephx key rotation feature,
which follows overlapping rotation for non-daemon keys.
Refer to the cephx rotation API from design PR 15915 for details.
Signed-off-by: subhamkrai <srai@redhat.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a new flag `--cephx-key-rotate` to rotate the
cephx keys genrated by external python script,
If we enable it, it will create a new user with suffix `.{x}`
Signed-off-by: parth-gr <partharora1010@gmail.com>
Rotate cephx keys for all the MDS daemons based on the cephxConfig in
teh cephCluster CR. Update the cephxStatus in the cephCluster CR and
cephfileSystem CR.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a cephclient api support to rotate the
cephx keys genrated by cephclient
Signed-off-by: parth-gr <partharora1010@gmail.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Now rook supports the six most recent minor versions of helm along with
their patch updates. I. e. helm 3.13 and newer is supported.
Fixes: #15980
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
This improves the guide for deploying ceph clusters with helm
from development builds.
The missing piece was deploying the operator chart before the cluster
chart. The operator chart is needed as it installs the CRDs
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
This change clarifies the description of the test environment in the
contributing guide with respect to the installation of helm.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
In #15961 I updated the rgw docs, but I was looking at the published
docs and the bulleting is broken now for Gateway Settings. When I was
working on the PR I was just using the markdown preview in my editor and
wan't using the `docs-preview` target. It turns out that the markdown
editor and mkdocs render things differently.
This PR fixes the bullet formatting and I verified the fix by running
`make docs-preview` on my box and double checking the local website.
Signed-off-by: Elias Carter <elias@dropbox.com>
This change allows the chart consumer to optionally
edit PrometheusRule CR by either disabling individual
alerts or tweaking their configuration.
Signed-off-by: Artyom Babiy <artyom.babiy@gmail.com>
The development guide mentioned that `tests/scripts/helm.sh up` would
install and set up the charts built under `_output/charts`.
This is not correct as the script only downloads helm to a temporary
directry.
This change improves the dev guide by removing these incorrect
statements.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
tests/scripts/helm.sh clean is not implemented.
So remove frpom the script's help text
and from the development guilde
Signed-off-by: Michael Adam <obnox@samba.org>
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
The documentaiton around object store certificates does not specify how
to deal with internally issued certs being used on the RGW. From my
testing it is possible to get the rook operator to validate the RGW
certs if the entire certificate chain is put into the `cert` field of
the `sslCertificateRef` secret.
Additionally, the docs are linking to a broken civetweb link but rook is
now using the beast frontend, so I fixed that link to point towards the
beast frontend documentation instead.
There was also some confusion around the `caBundleRef` and how that is
used so I made the docs more explicit that the `caBundleRef` is used by
the RGW to connect to external services such as LGW and mulitsite RGW.
Signed-off-by: Elias Carter <elias@dropbox.com>
Allow to assign custom labels for toolbox deployment. Some audit policies require specific labels for all kubernetes objects.
Signed-off-by: Juri Malinovski <juri.malinovski@coolbet.com>
mergify[bot]
parth-gr
Blaine Gardner
Michael Adam
Travis Nielsen
Santosh Pillai
Madhu Rajanna
subhamkrai
subham rai
synthe102
raaizikandTravis Nielsen
Oded Viner
Muhammad Adil Ghaffar
Deepika Upadhyay
Liang Zheng
Satoru Takeuchi
Elias Carter
Artyom Babiy
Juri Malinovski