the labels listed under the 'monitoring' section are currently only
being applied to the rook-ceph-mgr ServiceMonitor. This change extends
those labels to also include the rook-ceph-exporter ServiceMonitor.
Fixes: https://github.com/rook/rook/issues/13774
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit 10e26709c4)
We have prohibited changing all network-related configurations after cluster creation.
However, as a result of https://github.com/rook/rook/discussions/13584, we found that
the connections.encryption flag can be regarded as an exception.
Signed-off-by: ESASHIKA Kaoru <kaoru-esashika@cybozu.co.jp>
(cherry picked from commit 9ceb8aa7e0)
The patch version was pinned which caused problems
with security patches. Unpin it and always check
for new patch version
Signed-off-by: NymanRobin <nyman.robin@gmail.com>
(cherry picked from commit fdacd1e587)
During cluster creation, csi config map was first filled with
mon ips and without CSIDriverOptions.
This commit makes sure CSIDriverOptions are added at the begining
when the entry is first created.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 330f604cca)
# Conflicts:
# pkg/operator/ceph/csi/cluster_config.go
# pkg/operator/ceph/csi/cluster_config_test.go
the rgw service was removed, because users reported certificate
issues when Rook created Services for RGWs that had TLS (HTTPS) enabled.
It is now up to the user to create a Service if they want to use one.
part-of: https://github.com/rook/rook/discussions/13863
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 2c922c2879)
The rook/ceph Dockerfile uses dnf to ensure iproute (containing the 'ip'
CLI tool) is installed in the Rook image for Multus usage. This comes
from the 'baseos' repo, but if any other repos are unavailable
temporarily, it can cause the container build to fail.
Use the '--repo baseos' flag to help prevent these kinds of failures.
Additionally, this will speed up the build slightly since it does not
attempt to load any non-necessary repos.
This change may make the container build slightly fragile in the future
if CentOS changes the name of its baseos repo, or if the Ceph image
switches to a non-CentOS base image.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 072884f451)
currently the script requires to have both v2 and v1 port
to enable v2 port, but that is not the necessary condition,
so removing the chek, and enabling it only v2 is present to
successfully configure with v2 only
part-of: https://github.com/rook/rook/issues/13827
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 117bc76f20)
Go is not cgroup aware and by default will set GOMAXPROCS to the number
of available threads, regardless of whether it is within the allocated
quota. This behaviour causes high amount of CPU throttling and degraded
application performance.
Fixes: #13815
Signed-off-by: Thomas Way <thomas@6f.io>
(cherry picked from commit 97e3e69bf4)
cephFs fencing needs more testing and bug fixes to make
it in production. We tried multiple fixes but still it need
more work. So, removing the cephfs networkFence realted code
will rever this commit when we start working on this again.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit bd4250f56e)
earlier, we were only checking the specs of networkFence to see if
unfencing is done before proceeding with deletion but we should also
check the status of networkFence before proceeding with deletion.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 0ace7cf8cf)
If the spec.mon.count is 5 or more, then create
mon pdbs with maxUnavailable count as 2. We can
afford to have more than 1 mons down while
draining the nodes in this case.
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit a4866b4b06)
Reduce CRD size by removing some descriptions for things that
(a) are long, (b) are repeated, and (c) are commong kubernetes types.
Remove the `Status` field from VolumeClaimTemplates (a.k.a. PVCs) in
types.go to remove all unnecessary status-related fields.
Use `yq` to go through generated `crds.yaml` to strip out descriptions
for well-known k8s types that are long and repeated where we can't
remove them from types.go. This is mostly placement descriptions and
volumeSource descriptions.
The overall `crds.yaml` file is reduced to less than 60% of its original
size.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
Co-authored-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit bd7477ec61)
# Conflicts:
# deploy/charts/rook-ceph/templates/resources.yaml
# deploy/examples/crds.yaml
The crush rule will be updated when the failure domain changes.
This update can be skipped when the expected crush rule is
already configured. Otherwise, the log has a confusing message
that makes it appear that the crush rule was updated
when in fact it was not.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 90bec31203)
retry other cephfs/rbd pvc if there
are no active clients found on ceph cluster.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit ca21bd9715)
to keep the code consistent and to propogate
more details about error rook uses error wraping.
updating current code whereever its required to
wrap the details.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit eb97390df2)
The cephfs PVC might exist on the kubernetes
node object but due to some timing issues the
ip might not be visible on the ceph cluster or
the client might already got evicted or disconnected
from ceph cluster. In this case we will not be
able to get IP details for the subvolume and we dont
have any check for empty ip's in the code and rook
tries to create NetworkFence CR with empty Ip's
and the NetworkFence will get moved to the Failed state.
This PR adds the necessary check and logging to prevent
this one.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 0e115c44bf)
since networkFence is a cluster-based resource so that we don't need
the namespace and ownerReferences as it cause garbage-collector errors.
Also, now we create the networkFence with clusteUID label so when doing
cleanup we match the cephCluster uid and networkFence label clusterUID.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 5bff860380)
Mgr sidecar was using a privileged security context because it needed
to create the /var/lib/rook directory, generate the config on it, and
then copy it to the /etc/ceph directory. This change creates empty
directories on /var/lib/rook and /etc/ceph so the mgr sidecar can use
them, removing the need for using a privileged security context.
Fixes: https://github.com/rook/rook/issues/13719
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit db4b3322fa)
Fixes: #13692
Since the introduction of the "host" network provider, the legacy
"hostNetwork" setting is intended to be used only in combination with
the default network provider (""), but the code did not enforce this.
This change adds the required validation checks to throw errors
in invalid constellations.
These checks are added both in the operator's input validation code
and as kubernetes x-validation admission policies in the Cepcluster CRD.
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 25aa15e6c1)
Redouane Kachach
Travis Nielsen
mergify[bot]
ESASHIKA Kaoru
NymanRobin
Rakshith R
Blaine Gardner
parth-gr
subham rai
Alexander Trost
Madhu Rajanna
karthik-us
Thomas Way
subhamkrai
sp98
Tim Olow
Michael Adam