When the strategy type of deployment is Recreate, from the moment the end is
started until the new pod is normally running, there is no pod in the
kubernetes service endpoints, so it goes to the service unavailable state.
Therefore, it is necessary to change it to `type: RollingUpdate` instead of
`type: Recreate` so that rolling updates can be made without downtime.
Before Pacific, creating a deployment as much as the instance was okay,
but after Pacific, the replicas was increased in one deployment, so rolling
updates were set up one by one as in the previous version.
Signed-off-by: micalgenus <micalgenus@gmail.com>
Linux doesn't guarantee file ordering, so when dealing with files in
order, we can use 'sort' to make sure the order is deterministic. For
yq's usage of files, we need to keep file names in an intermediate
variable, and this should be an array to support file paths with spaces.
'readarray' is not available on MacOS's built-in bash, so a longer
'while read' loop is needed for the array creation.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
When the active mgr changes, there may be user-created services
that also need to have their selector updated to point to the
new active mgr. Now the operator will update any service in the
rook operator namespace that has the label app=rook-ceph-mgr
to point to the active mgr.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The helm tests were previously only for new installs, and did
not have an upgrade path. Now the upgrade path is tested
to give confidence in the helm upgrades.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The test suites were triggered by Jenkins potentially
using different versions of K8s and environment variables.
There is no longer a need for these environment vars to
determine which test suites should be run. The test
suites to run can just be triggered directly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Previously we were using the namespace, it's a mistake, even though most
clusters use the same name as the namespace.
Let's be precise and use the cluster name when looking for it.
Signed-off-by: Sébastien Han <seb@redhat.com>
right now the RoleBinding for monitoring is created with the cluster namespace as the subject
this causes the operator to loop on reconcile due to it not having permissions to create monitors
in the other cluster
moving the subject to the operator namespace fixes this
Signed-off-by: Henry Zhang <me@henry.dev>
The local build tag replacement in the CI should work the same
whether in master or release branches, so we use a regex to
match any rook/ceph tag to be renamed to the local-build tag.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The info email list and rook-dev forum are targeted frequently by
spam and otherwise not used by the community. Let's focus on the
useful channels of slack, github, and security emails.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Rook needs to be able to watch all `ceph.rook.io` resources to reconcile
them; however, it does not need blanket verb privileges. Reduce the
privileges as much as possible.
Ideally, Rook would only have update permissions to status and
finalizers of resources; however, finalizers are not a full-fledged
subresource at this time, and "update" permissions must be maintained
for `ceph.rook.io` resources.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
Recently with the directory renaming to "deploy/olm" the CSV name
changed from "ceph" to "olm". Now we are using the same "rook-ceph" name
regardless of the platform.
Signed-off-by: Sébastien Han <seb@redhat.com>
If helm is not install, `make` fails with the following log.
```console
./build/rbac/get-helm-rbac.sh: line 25: helm: command not found
```
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
the events are used to mark the start/success/failure of the reconciliation
and also to log the bucket names on which the CephbucketNotification is
created
Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
micalgenus
Travis Nielsen
Sébastien Han
Blaine Gardner
Yuval Lifshitz
Henry Zhang
dependabot[bot]
parth-gr
Satoru Takeuchi
subhamkrai
Robert Spier