When the strategy type of deployment is Recreate, from the moment the end is
started until the new pod is normally running, there is no pod in the
kubernetes service endpoints, so it goes to the service unavailable state.
Therefore, it is necessary to change it to `type: RollingUpdate` instead of
`type: Recreate` so that rolling updates can be made without downtime.
Before Pacific, creating a deployment as much as the instance was okay,
but after Pacific, the replicas was increased in one deployment, so rolling
updates were set up one by one as in the previous version.
Signed-off-by: micalgenus <micalgenus@gmail.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
When the active mgr changes, there may be user-created services
that also need to have their selector updated to point to the
new active mgr. Now the operator will update any service in the
rook operator namespace that has the label app=rook-ceph-mgr
to point to the active mgr.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
the events are used to mark the start/success/failure of the reconciliation
and also to log the bucket names on which the CephbucketNotification is
created
Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
This is handling a tricky scenario where the OSD deployment is manually
removed and the OSD never reconvers. This is unlikely to happen, but
still OSD should be able to run after that action. Essentially after a
manual deletion, we need to run the prepare job again to re-hydrate the
OSD information so that the OSD deployment can be deployed.
On encryption, it is a little bit tricky since ceph-volume list again
the main block won't return anything, so we need to target the encrypted
block to list.
There is another case this PR does not handle, which is the removal of
the OSD deployment and then the node is restarted. This means that the
encrypted container is not opened anymore. However, opening it requires
more work like writing the key on the filesystem (if not coming from the
Kubernete secret, eg,. KMS vault) and then run luksOpen. This is an
extreme corner case probably not worth worrying about for now.
Signed-off-by: Sébastien Han <seb@redhat.com>
Current approach is to delete all the existing notifcations from bucket
and re-add the notification from the labels.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Rook does not support running multiple clusters in the same namespace,
so the operator should not reconcile if a new cluster is added.
The scenario where a cluster is added while the operator is down is also
handled. CR updates are also handled.
When the operator detects more than one cluster it will refuse to
reconcile the CephCluster, and child CRDs will block too until the
operator is ready.
The user must remove one of the clusters before can continue to perform
any reconcile.
Closes: https://github.com/rook/rook/issues/9452
Signed-off-by: Sébastien Han <seb@redhat.com>
The mons need to be configured to skip the mds sanity check
during upgrade to 16.2.7 or the mons may crash during that
upgrade.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The original PR which added event reporting unnecessarily "optimized" to
prevent spamming the API controller[1].
It is sometimes important to get events as they happen and not hide new
events behind preexisting older events. For example, in integration
tests, we may often want to wait for a controller to finish processing
an update, and the best way to do that is to wait for the
"ReconcileSucceeded" event. In order for this to be useful, the events
must be reported each time.
If we begin having problems with events being reported too often, then
we should fix the underlying issue of reconciles happening too often
instead of relying on a time-based "optimization" that hides recent
event reports that may be useful.
[1]: https://github.com/rook/rook/pull/7222
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
When CephBlockPool, CephFilesystem, or CephObjectStore resources are
deleted after removing their finalizer, the code path to stop monitoring
was not stopping monitoring since a non-present resource does not have a
name and namespace attached. When the object is deleted, ensure the
internal representation used to stop monitoring has a name and namespace
to fix the issue.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
For now, we must run the container with UID 0 and privileged for
multiple reasons:
* the rook binary writes ceph config to /var/lib/rook which is owned by
root
* it's difficult to use /etc/ceph since it will conflict with the
rook-ceph-override configmap AND is also owned by root since it's a
mounted configmap.
* using /etc/ceph might be possible but has other issues with rook's
exec package since the ceph config is built from /var/lib/rook
Closes: https://github.com/rook/rook/issues/9385
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit adds context parameter to k8sutil replicaset and secret
functions. By this, we can handle cancellation during API call of
replicaset and secret resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil service functions. By
this, we can handle cancellation during API call of service resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil pvc functions. By this, we
can handle cancellation during API call of pvc resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil prometheus functions. By
this, we can handle cancellation during API call of prometheus resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil endpoint functions. By
this, we can handle cancellation during API call of endpoint resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil configMap functions. By
this, we can handle cancellation during API call of configMap resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil kvstore functions. By
this, we can handle cancellation during API call of kvstore resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
We need to use the root UID to run the cleanup job since ceph-volume
does not support running as non-root in all the versions. We have this
ceph tracker to allow this https://tracker.ceph.com/issues/53511 but
it's not in all ceph's versions. Implementing a version check is tricky
since at this stage the cluster is being deleted and it's hard to catch
it.
Closes: https://github.com/rook/rook/issues/9375
Signed-off-by: Sébastien Han <seb@redhat.com>
Remove the poolConfig in CephNFS to prevent different CephNFS CRs from
contending to change the replication spec of the default NFS pool.
Resolves#9355
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Let's catch the correct error when no cluster info exists yet. If we
have another error, we fail the orchestration and try again. This could
help up catching small API hiccups for example.
Signed-off-by: Sébastien Han <seb@redhat.com>
Let's have a more accurate and correct error message that reflects what
the failing function tried to do.
Signed-off-by: Sébastien Han <seb@redhat.com>
micalgenus
Travis Nielsen
Sébastien Han
Blaine Gardner
Yuval Lifshitz
Satoru Takeuchi
Jiffin Tony Thottan
Denis Egorenko
Yuichiro Ueno