The charts have no unit tests. CI runs ct lint plus a helm template and
kustomize build, which prove the charts render but never assert what
they render, so conditional template logic goes unverified.
Add helm-unittest, pinned and installed as a standalone binary, a
test.helm make target, and a Helm Unittests workflow that runs it. The
first suite covers the toolbox deployment: the image composed from the
toolbox and cephImage settings, the precedence of both over the older
toolbox.image setting, the hostNetwork branch driven by the cluster
network provider, and the revisionHistoryLimit guard.
The new job is a required check in .mergify.yml, alongside the existing
chart linting.
Suites live under tests/ in a chart and are excluded from the packaged
chart via .helmignore. The runner is invoked with --strict so that a
misspelled key fails the suite instead of silently rendering defaults.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Added failureDomains and osdsPerDomain fields to the
ErasureCodedSpec, which maps to the crush-num-failure-domains and
crush-osds-per-failure-domain Ceph EC profile parameters. This enables
creating EC pools that distribute chunks across fewer, larger hosts
without needing one host per data chunk.
Signed-off-by: Prabhala Tara Aasrita <taraprabhala@Prabhalas-MacBook-Pro.local>
When NFS runs with host networking, port 2049 may already be in use.
Add CephNFS spec.server.port (default 2049), wire it through Ganesha
config, the operator Service, and probes, and regenerate CRDs.
Signed-off-by: raaizik <raaizik@yahoo.com>
The operator image in the rook-ceph chart and the Ceph image in the
rook-ceph-cluster chart are both configured as a repository and tag
pair. The toolbox was the exception, taking a single toolbox.image
string.
Add toolbox.repository and toolbox.tag, so the toolbox image can be
configured the same way as the others. Either setting may be applied on
its own; whichever is left unset falls back to cephImage.repository or
cephImage.tag.
The new settings take precedence over toolbox.image, which continues to
apply when neither is set, so existing values files are unaffected.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Changes:
- Use a dedicated .nvmeof pool (via CephBlockPool CR named
builtin-nvmeof) for the NVMe-oF gateway internal state.
- Use a separate nvmeof pool for the StorageClass data.
- Remove the pool field from the CephNVMeOFGateway CRD.
The gateway now always uses the .nvmeof pool, hardcoded
in the operator.
- Add .nvmeof to the allowed CephBlockPool name overrides.
- Create a production example nvmeof.yaml (instances: 2,
replicas: 3) and a CI-only nvmeof-test.yaml (instances: 1,
replicas: 1).
- Update documentation and CI test script accordingly.
Signed-off-by: Oded Viner <oviner@redhat.com>
this commit add support for updating rgw caps with
`user-info-without-key` and `accounts` to cephobjectstoreuser crd
Adding the check for min ceph version from which these caps
are available.
Co-Authoured-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: subhamkrai <srai@redhat.com>
Aggregate pool usage by pool before predict_linear to avoid duplicate series after mgr pod replacement, and add a one-hour hold time to match the source rule update in ceph/ceph#68621.
Signed-off-by: Jeff Wallace <jeff@tjwallace.ca>
Updated the required documentation and yamls
where we are adding support for the QoS for
the rbd pvc that uses the krbd mounter.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Add optional CephObjectRealm, CephObjectZoneGroup, and CephObjectZone
resources to the rook-ceph-cluster chart so an RGW multisite topology can
be deployed from the chart alongside CephObjectStore.
Each resource type follows the existing per-list template idiom: a new
template ranges over a values list and renders name, namespace, and spec.
The realm template renders spec only when set, supporting both a new realm
(no spec) and a pulled realm (spec.pull.endpoint).
The three lists ship commented out in values.yaml with a multisite
example, matching the opt-in cephECBlockPools precedent, so a default
install creates no multisite resources.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Fix duplicate words, incorrect articles (a/an), it's/its, and other small
grammar mistakes in Go comments and user-facing messages across pkg/, cmd/,
and tests/.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Several godoc comments led with a stale or incorrect identifier, left
over from renames, exported/unexported changes, copy-paste between
sibling declarations, or plain typos. As a result the documented name no
longer matched the function, method, type, or var it describes. Correct
each leading word to the name of the declaration it documents.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
adding api changes to mute/unmute ceph warnings
based on user configuration. The field is map[string]string
key is ceph warning and value is duration how longs
the warnings will be muted.
Signed-off-by: subhamkrai <srai@redhat.com>
Make the NVMe-oF gateway image optional in the CR spec.
When not specified, the operator fetches the image from
the Ceph mon config store using the key
mgr/cephadm/container_image_nvmeof. Falls back to the
hardcoded default if the config is unavailable.
Signed-off-by: Oded Viner <oviner@redhat.com>
The helm values need to be updated if installing the drivers
chart in a namespace other than rook-ceph.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
adding rook compatible Ceph-Csi driver values.yaml
file making sure, upgrading to 1.20 doesn't break
when csi-driver is moved to admin.
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
adding new tls ssl_ciphersuites supporting tls 1.3 and the existing,
ssl_cipher supports tls 1.2 and below. Adding, the docs and unit-test
changs as well.
Signed-off-by: subhamkrai <srai@redhat.com>
this commit update the csi-operator to latest v1.0.0.
we need to manually patch the csi drivers with the new serviceAccount
name that are being creating based on the latest ceph-csi-operator
release v1.0.0 where serviceAccount are being separate from csi-operator
chart.
co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
this commit adds flag stripe_unit for the command
ceph osd erasure-code-profile set [flags]. This key
increase perfomance for ec pool. The default value
is 4kib/4096 bytes.
Signed-off-by: subhamkrai <srai@redhat.com>
the nvmeof gateway requires privileged containers with
sys_admin capability. the rook-ceph scc only allowed mknod,
causing pod creation to fail on openshift with:
"unable to validate against any security context constraint"
add sys_admin to allowedcapabilities in the helm chart sccs
and the go scc helper. this does not affect other daemons
(osd, rgw, mgr, mon) since they do not request sys_admin.
the operator-openshift.yaml example already includes
sys_admin, so this aligns the helm charts to match.
Signed-off-by: Oded Viner <oviner@redhat.com>
Added monRunAsRoot chart value to support the ROOK_CEPH_MON_RUN_AS_ROOT environment variable in the operator ConfigMap.
Fixes#17452
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
this commit add option in the ceph objecstore CR
to configure TLS profile and TLS ciphersuite for
rgw beast.
Signed-off-by: subhamkrai <srai@redhat.com>
The cmd-reporter ResourceRequirements are used by the
`rook-ceph-detect-version` pod. Setting a default ResourceRequirement
is useful in and of itself while always allowing the `values.yaml` serve
double duty as a configuration example.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Going forward, admin will manage the csi operator
CR's and rook will only manage Ceph Connection cr
and client Profile cr.
The old csi driver is completely removed from Rook
and can no longer be used starting in Rook v1.20.
The upgrade guide will contain the needed transition steps
for managing the csi operator settings.
Signed-off-by: subhamkrai <srai@redhat.com>
With the default version now being v20.2.1, also update
all of the examples, documentation, and default CI to run
with that version
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
the rook-ceph-nvmeof service account is not listed in the
securitycontextconstraints users, causing cephnvmeofgateway
pods to fail on openshift. add the service account to the
scc in the helm charts, go scc builder, and test namespace
substitution.
Signed-off-by: Oded Viner <oviner@redhat.com>
Clean up stale CRUSH rules after the Ceph mgr starts so rules left behind by pool failure-domain or device-class changes do not accumulate indefinitely.
The cleanup is guarded by a package-level RWMutex. Pool create and update paths hold the read lock while creating and assigning CRUSH rules, while cluster-wide cleanup holds the write lock before listing pools and deleting unused rules. This keeps pool reconciles parallel with each other while preventing cleanup from deleting a rule that another reconcile has just created but not yet attached to a pool.
Keep direct pool-delete cleanup for the pool's current CRUSH rule, make the cluster-wide cleanup best-effort across all unused rules, and add an operator-level ROOK_DELETE_UNUSED_CRUSH_RULES setting for clusters that need to leave unused custom rules in place.
Document the operator and Helm settings, regenerate the Helm chart docs, and add a pending release note for the default cleanup behavior.
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
This parameter is written to .spec.cephFS.radosNamespace of the generated
ClientProfile.
The parameter is called 'CSIMetadataRadosNamespace' to clarify that it is used
for CSI metadata and unrelated to the actual CephFS (meta)data.
Context:
The ceph-csi CephFS plugin stores additional metadata related to PV(C)s
in RADOS objects in the metadata pool of the CephFS.
By default those objects are stored in the 'csi' RADOS namespace.
For a multi-tenant CephFS setup (that is used by multiple K8s Clusters/
ceph-csi drivers) segregating those additional objects into separate RADOS
namespaces is desireable so the clusters can not modify the metadata of other
clusters (enforced by appropriate ceph client capabilities).
'ceph-csi' implemented this via the `cephFS.radosNamespace` config option for
cluster entries in the `ceph-csi-config` ConfigMap with https://github.com/ceph/ceph-csi/pull/4661.
The `ceph-csi-operator` added support for that config entry by adding
'radosNamespace' to the 'CephFsConfigSpec' of the 'ClientProfile' with
https://github.com/ceph/ceph-csi-operator/pull/165.
Signed-off-by: Alexander Degenhart <degenhart@fim.uni-passau.de>
Previously the unreachable node toleration on the operator pod was hardcoded to 5 seconds in the Helm chart and the ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS env var was notset up at all. This change reads both from .Values.unreachableNodeTolerationSeconds (defaulting to 5).
Fixes#17303
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Joshua Hoblitt
Travis Nielsen
Prabhala Tara Aasrita
raaizik
Oded Viner
Blaine Gardner
subhamkrai
Joshua Hoblitt
Jeff Wallace
Madhu Rajanna
Praveen M
Prabhala Tara Aasrita
Asish Kumar
Elias Carter
Alexander Degenhart