Rename PodLabels function to CephDaemonAppLabels for more clarity about
what the function's purpose is.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
This can help users identify the daemon type similarly to how
'ceph_daemon_id' helps identify the daemon ID. This also makes it so
scripts users create don't have to parse "app=rook-ceph-<daemonType>"
into "<daemonType>" if they desire that bit of info.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
using defer for closing file which are open
for writing is not safe. so closing file again
following below steps:
1. open files
2. defer file.close()
3. write
4.file.close()
these will make sure files are closed.
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
File permissions need to be reduced to the minimum to avoid config
files from being accessed. While a connection to the pod would be
required to access the files, min privileges are set just as
another layer of security. This fixes gosec error G306.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit fixes where there are areas in which files and directories are
written and created with statically defined permissions. Many of these
permissions are rather open, potentially allowing other system tenants to
view and interact with their contents, which may be sensitive.
Fixed G303: Poor file permissions used for directory by using the most narrow permission
Resoves: https://github.com/rook/rook/issues/4580
Signed-off-by: Nizamudeen <nia@redhat.com>
The name generation utils need to provide consistent outputs across
versions so that names generated based on values are consistent and
older generated keys are not lost.
Signed-off-by: Rohan CJ <rohantmp@gmail.com>
Adding new apis such as EnableUserQuota() for enabling quota,
SetQuotaUserObjectMax() and SetQuotaUserMaxSize() for setting user specific quotas
for objects and size respectively. Please note the size is quota is determined in GBs.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
this commit handles all the gosec g601
error code (i.e Implicit memory aliasing
of items from a range statement).
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
this commit suppress the gosec errors for
g204: Audit use of command execution.
g304: File path provided as taint input.
g101: Look for hard coded credentials.
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
as we are going to deploy snapshotter by
default we are going to remove the kubernetes
version check.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
To ensure a file handle is closed, we defer the close command
so it is guaranteed to run when the method returns. The closing
of the file handle is not going to fail in our usage since we aren't
using the SetDeadline on the files that would cancel a request
and return an error.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Added a provisioner toleration to the csi version
check job, so that we can schedule the csi version
check on the node where the nodes are tainted.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
If the AllowUnsupported flag is set to true we should
not check the csi version as it will be kind of no-op
as even incase of failure we continue. if we disable
the version check in this case,the deployment will
be little faster as we dont wait for version check
to complete to start CSI pods.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Somehow, the client.Update was not updating the cluster object, using
client.Status().Update actually fixed it.
Signed-off-by: Sébastien Han <seb@redhat.com>
Instead of setting the Phase of the CR once the reconcile is done, let's
actually set in from the healthcheck so it is more accurate.
Closes: https://github.com/rook/rook/issues/5249
Signed-off-by: Sébastien Han <seb@redhat.com>
When we run the goroutine, we should run start it immediately instead of
waiting for the configured interval to start. With that we can get the
Status Phase reported much faster in the CRD.
Signed-off-by: Sébastien Han <seb@redhat.com>
At startup there is a race condition between the goroutine checking
for mon health and the first reconcile of the mons. There is a lock
that ensures only one of them will check the mon health at a time.
The issue is that if the wrong one gets there first, it will not
have the desired mon count initialized from the cluster CR as expected
and the healther checker will use a desired mon count of 0.
The desired count of 0 leads the health checker to remove
a mon since there are extra mons. Only one mon is allowed
to be removed at a time, and adjusting to fewer than two mons is
disallowed once there are at least two mons.
After the health checker is completed, the main reconcile of the mons
will proceed with the correct desired mon count of 3 and attempt
to restore to the real desired quorum size.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The mon was starting with a partial spec. There was a race condition
that was causing incorrect initialization in the health check goroutine
that could remove a mon upon operator restart. Now the mon will be
properly initialized with the full spec.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Blaine Gardner
Jiffin Tony Thottan
Travis Nielsen
subhamkrai
Nizamudeen
Rohan Joseph
Sébastien Han
Madhu Rajanna