finally, admission controller will be enabled default
without any script/manual step. But it still requires cert-manager
to be installed which I believe is already installed in clusters.
**Note**
Code doesn't return error it just logs the error since
we don't want to stop reconciling if the admission controller fails.
We can work on this once the admission controller is stable.
Signed-off-by: subhamkrai <srai@redhat.com>
Removed v3.4.0 as its deprecated in cephcsi
and updated the templates to point to latest
v3.6.0 release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
For supporting features like service account authentication for vault
KMS , a service account account need to attach with pod.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Previously, the struct maintaining the list of cluster was still
initialized with a cluster item. Then the monitoring check will see that
the cluster is part of the struct already and thus won't run the
monitoring go routine again.
Now each time we cancel the context, we also remove the cluster item
from the map so that when the controller runs again, the monitoring
struct is re-populated and the go routine runs and statuses are updated.
Closes: https://github.com/rook/rook/issues/9911
Signed-off-by: Sébastien Han <seb@redhat.com>
This oidc-token is used to authenticate with OpenID Connect (OIDC)
Provider. Currently, Ceph-CSI uses it to assume role with amazon STS
to get access to aws kms for encryption.
Signed-off-by: Rakshith R <rar@redhat.com>
The aws go lang sdk needs value for region, it is set differently in
various part of current code. With PR the value is always `us-east-1` so
that it will work RGW server without any issues.
This reverts commit 280c29f330.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The prometheus rules had been previously created if the cephcluster CR
setting monitoring.enabled was set to true. The rules were not customizable
and therefore not flexible enough. Now the rules are installed by the helm
chart. To customize the rules, a post-processor can be applied to the helm
chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Older kernels still fail to connect for rbd/cephfs with
the msgr2 port due to a difference in http protocol expected.
For now, we keep the default port as msgr1 for the csi driver
and other client connections, unless msgr2 is strictly required
for encryption or compression.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In Quincy, the device_health_metrics pool is renamed to .mgr.
In the example cluster-test.yaml, we therefore update the
example to create the pool with the new name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
adding observedGeneration field in the cephcluster cr
status for having better control on reconciling,
as observedGeneration field will be updated by the controller
Closes: https://github.com/rook/rook/issues/9673
Signed-off-by: parth-gr <paarora@redhat.com>
Added few test cases to check for the following:
* creation of an external object store
* deletion of an external object store
* creation of an external object store with a missing secret
* creation of an external object store with ExternalRGWEndpoints set to
nil.
Signed-off-by: Pranshu Srivastava <rexagod@gmail.com>
ReportReconcileResult should never be given an object that is nil. It is
impossible to force compile-time checking for this because the object's
type is an interface. We can't force this, but we can rework the
function definition to handle more cases where the object may not be
returned fully-complete, and we can rework callers to return structs
(not pointers-to-structs) so it is less likely a caller will pass nil
to the function.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The canary pods are very short-lived pods and are not
running ceph in any form. The startup probe was mistakenly
enabled for the canary pod, which could cause the pod
to fail unexpectedly if the startup probe was triggered
after the delay timeout.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
msgr2 allows for encryption and/or compression across the wire.
Settings for enabling the encryption and compression are now
available in the cluster CR to that ceph will be automatically
configured with these settings when desired.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Since Nautilus, mgr2 is already enabled by default. No longer
does the operator need to enable msgr2 after the mons are
configured or upgraded.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
If the csi driver was enabled at a later time, the mon endpoints
would not be populated. The populate the csi config, either a new
cluster reconcile or restarting the operator would be necessary.
It is simpler just to update the csi configmap with every reconcile
even if the csi driver is not enabled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
If the pod namespace was not found by the csi helper to update
the mon endpoints configmap, the reconcile was failing. To allow
for the update to continue in unit tests and ignore the env var,
we only log the warning instead of failing the reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When downscaling CephNFS clusters, be sure to remove secrets and
configmaps. Also be sure to only downscale for the currently-reconciling
CephNFS cluster.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The controller for disruption budgets is verbose at cluster creation
when the cluster is not yet created, which generates a lot of noise
in the log that makes the cluster look unhealthy. This is an expected
condition, so we can change this logging to debug level.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Currently, the admin/user can configure the ceph.conf
for daemon pods using https://rook.io/docs/rook/v1.7/
ceph-advanced-configuration.html#custom-cephconf-settings.
This the above custom ceph.conf is only for ceph pods.
the support to provide constom ceph.conf for cephcsi
is added in cephcsi PR 2476
This PR adds the support to create/update
ceph.conf for csi pods.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The purge job is intended to clean up all the resources
related to an OSD that is to be removed. An OSD with
a metadata, wal, and data PVC was only cleaning up the
data PVC. Now the metadata and wal PVCs will also be
cleaned up.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
If the filesystem is in a bad state such as never being
created successfully in the first place, the filesystem
removal will continuously fail and prevent the CR from
being removed. Thus, we treat the filesystem removal
as a best effort and log the issue instead of failing
the uninstall reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Added unit test for probes changes and
did re-naming of liveness probes file
as it will contain multiple types of probes
Signed-off-by: parth-gr <paarora@redhat.com>
currently if multisite is not configured Rook sets values for
zone/zonegroup/realm as object store name which is only valid for
internal ceph object store. This may not exists for rgw running in
external cluster.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
We don't need to validate the name of Ceph-CSI secret, simply because
the names can be different. The default example have default names but
since the secret can be created by the administrator we should not
assume anything. This check will fail if the secret names are different
for whatever reason. This is especially true for external mode. In
converged mode Rook creates the secrets on its own if needed to ease the
integration with the default StorageClass examples.
Signed-off-by: Sébastien Han <seb@redhat.com>
The external code has its own mechanism to look up the clusterInfo so
let's move this to the non-external condition to clarify the code.
Signed-off-by: Sébastien Han <seb@redhat.com>
This is fixing a potential race where the context is canceled and the
external cluster is trying to fetch the cluster info. If the context is
canceled then the loop will be stuck forever. Now we check for the
canceled context and return appropriately.
Signed-off-by: Sébastien Han <seb@redhat.com>
Instead of setting the default values in the Rook
we should use the defaults provided by the ceph
it self. This configuration is causing problem
for the rbd image creation, this is not allowing
the rbd images to have default image features
which comes with librbd.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
subhamkrai
Madhu Rajanna
Jiffin Tony Thottan
Sébastien Han
Travis Nielsen
Rakshith R
Divyansh Kamboj
parth-gr
Blaine Gardner
Pranshu Srivastava
Tom Hellier