rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the ceph exporter daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9ec7a767c3)
Implement automated CephX key rotation for OSDs.
OSDs have marshalled CephX statuses applied as an annotation on the OSD
pod spec, which differs from other Rook Ceph daemons for a two reasons:
A large cluster could have hundreds or thousands of OSDs, so it is more
critical that Rook avoid rotating OSD keys more than once in the event a
CephCluster reconcile restarts partway through OSD creation/updation.
OSDs do not have their CephX keys stored in K8s Secrets, whose resource
version is used for enforcing the desired restart behavior other daemon
pods like RGWs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 4189a196c1)
rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the crashcollector
daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the subvolume group.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the radosnamespace.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This PR implements the CSI cephx key rotation feature,
which follows overlapping rotation for non-daemon keys.
Refer to the cephx rotation API from design PR 15915 for details.
Signed-off-by: subhamkrai <srai@redhat.com>
Rotate cephx keys for all the MDS daemons based on the cephxConfig in
teh cephCluster CR. Update the cephxStatus in the cephCluster CR and
cephfileSystem CR.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a cephclient api support to rotate the
cephx keys genrated by cephclient
Signed-off-by: parth-gr <partharora1010@gmail.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
nfs short name and crd name was same
which was conflicting,
remove the short name cephnfs as it can
be already called by the crd name
Signed-off-by: parth-gr <partharora1010@gmail.com>
there is a change from ceph on how the status
of the mirroring will look like,
Adopting with new fields so the status is correctly synced,
And other components might rely on the status too
Signed-off-by: parth-gr <partharora1010@gmail.com>
Provider validation is failing on updating from empty string to non-empty ones
which is expected to be supported. Fix the validation rule by adding one missing
condition.
Signed-off-by: Yifeng Zhang <Yifeng.Zhang@cerebras.net>
When a rados namespace is deleted, it cannot be purged
until its images and snapshots are deleted. Now a condition
is being added to the rados namespace CR status so the user
does not need to read the operator log to discover the cause.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Adds .spec.cephConfigFromSecret to CephCluster for loading
Ceph config parameters from a Kubernetes Secret.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
userSecretRef and passwordSecretRef fields are added to allow the Kafka
endpoint username and password to be supplied from a Kubernetes Secret,
rather than exposed as plaintext as part of the endpoint URI. If the
endpoint URI has HTTP basic auth user-id and user-pass components, they
are overridden by userSecretRef and passwordSecretRef.
Squid added bucket topic attributes for configuring the user-name and
password for pushing notifications to Kafka as an alternative to
encoding credentials into the URI. However, these attributes are not
supported under Reef. Thus, this initial implementation relies on URI
mangling for compatible with both Reef and Squid. Future work could
using Ceph version detection and switch to the new attributes to be used
with Squid and/or the implementation could be converted exclusively to
use the new attributes once Rook has dropped support for Reef.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
if no multisite is used, rook creates the zone,
in the same name as cephobjectstore cr,
But cephobjectstore zone spec
shows name as empty string("")
Which is confusing for the end user, so
to remove the confusion by updating the
api defination
Signed-off-by: parth-gr <partharora1010@gmail.com>
this commit add support for mirroring b/w implicit rados namespace and
defined rados namespace. To support this, rook will treat `<implicit>`
name on cephblockpool as `""` empty string. This will allow mirroring
b/w implicit and defined radosnamespace.
Signed-off-by: subhamkrai <srai@redhat.com>
allows selecting Read Affinity policy from the ObjectStore API
aets `--crush-location=host` for RGW daemons.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
One ore more OSDs can be down and PGs can still be active+clean (data
was rebalanced to other available OSDs). This PR sets
maxunavailable=1+downOSDs to allow one healthy to be drained.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Implements #14733. Allows to set IDs of external mons to
Cluster CRD. Rook will not remove external mons from quorum
and will add external mon addresses to mon endpoints.
Use-case for external mon is to maintain quorum for 2-AZ
k8s cluster in case of zone outage.
Signed-off-by: Artem Torubarov <artem.torubarov@clyso.com>
the rgw operations for s3 can now be accessible using sidecar
rgw-ops-log availabe in json form that can be further filtered logging
for observability, this will set the rgw_enable_ops_log setting
Signed-off-by: Deepika Upadhyay <deepika.upadhyay@clyso.com>
Implement #15119
Allow users to override RGW configurations by specifying Ceph config
options in the CephObjectStore. For configurations that require RGW to
be restarted when the config is applied, allow configs to be specified
as CLI arguments to the RGW as well.
This is an advanced option and is documented as such. Users should be
careful to understand the values they are setting, as there is no
validation to prevent the object store from breaking when these configs
are used.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
mergify[bot]
parth-gr
Blaine Gardner
Santosh Pillai
Travis Nielsen
Madhu Rajanna
subhamkrai
Muhammad Adil Ghaffar
Oded Viner
Patryk Rostkowski
Yifeng Zhang
Joshua Hoblitt
Ragnar Dahlén
Artem Torubarov
Deepika Upadhyay