When generating the HTTP client used for RGW admin ops, use both system
certs as well as the user-given cert.
As a real world example, admins may use ACME to rotate Letsencrypt certs
every 2 months. For an external CephObjectStore, the cert used by Rook
and RGW may not be rotated at the same time. This can cause the Rook
operator to fail CephObjectStore reconciliation until both certs agree.
When Rook also relies on system certs in the container, Rook's
reconciliation will not have reconciliation failures because
Letsencrypt's well-known and trusted root certificates can be loaded
from the system to validate the RGW's newly-rotated cert.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 7bb72a0171)
This PR adds the sample YAMLs and documentation
for the RBD VolumeGroupSnapshot.
Signed-off-by: Niraj Yadav <niryadav@redhat.com>
(cherry picked from commit 524b6071d2)
These fields must be optional in order to allow usage of pre-existing
pools managed by CephBlockPool CR(s).
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 76fa776795)
The ROOK_ENFORCE_HOST_NETWORK option was implemented recently
and now we add the helm setting to expose this new setting
in the rook chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 810de394e7)
This adds an operator config setting ROOK_REVISION_HISTORY_LIMIT
defaulting to kubernetes'value for RevisionHistoryLimit.
If configured, the provided value will be used as RevisionHistoryLimit
for all Deployments rook creates.
Fixes: #12722
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit ab8fd90aa6)
for cephfs fencing in external mode, we run command `ceph tell mds ***`
which requires user user to include cap mds allow * in permission. So,
we need to add this in healthchercker and cephfs provisioner user
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 32c5d99ef5)
allows to set prio-limit and stats-period options to ceph exporter
Signed-off-by: Artem Torubarov <artem.torubarov@clyso.com>
(cherry picked from commit b2c39ace25)
This PR adds the sample YAMLs and documentation
for the VolumeGroupSnapshot feature.
Signed-off-by: Niraj Yadav <niryadav@redhat.com>
(cherry picked from commit 1e3d08f114)
we have 3.12.2 as the new cephcsi release
updating the rook to use the same.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d041be4bcf)
Allow RGW users to mount arbitrary volumes to RGW pods. This follows the
pattern that was established for NFS to support SSSD and LDAP, and
reuses much of the same code.
This opens the door wider for advanced users to take advantage of some
Ceph RGW features that Rook doesn't have first class support for.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit eea43b7b79)
currently we created a new config file or user creation,
Which was have the user config.
We were also appending the script deafult values to the config file
With that all the boolean values were appended to the config.ini file
v2-port-enable = False
....
But the config.ini treat all the bolean values as true, irrespective of they
are set to, it is because the boolean cli flag doesnt accept the argument
So now removed all the false values from the config.ini
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit d2f8ce4c47)
when I was pusing the new changes in older pr I missed
updating the latest tag to v0.1.0 in csi-operator.yaml
file. Updating now.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 838f583c66)
Alerting on controller-runtime's workqueue_depth can be useful for
debugging controllers. Also having a prometheus target for a pod gives
another data point that the system is working as expected. It is useful
for uptime alerts.
Make the bind address configurable via the configmap while still retaining the default
behavior that it is disabled.
Resolves: #14538
Signed-off-by: Justin Cichra <jcichra@cloudflare.com>
(cherry picked from commit 74a79b24b3)
this commit contains changes that are forced by latest
controller-runtime version v0.19.0.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 2556e14780)
updating csi-operator version in go.mod and csi-operator.yaml
to use latest release v0.1. And also fixing one small bug
where csi-driver log level was set in csi-operator log level.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 89e9077e72)
Updating storageClassName for cluster-on-pvc.yaml file from gp2 to gp2-csi.
Signed-off-by: ShravaniVangur <shravanivangur@gmail.com>
(cherry picked from commit 9656d1963a)
The jobs to detect the ceph and csi versions now can have
custom annotationso and labels added to them. They are
very short-lived jobs, but they may need custom annotations
in some environments to run.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 5014d5bcf2)
As we have new csi-addons v0.9.0
updating the same here as well.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 123025f22c)
# Conflicts:
# go.sum
adding the CSI-operator manifest files
inside rook repo naming deploy/examples/csi-operator-manifests.yaml.
Also, let's skip running any lint check on file `deploy/examples/csi-operator.yaml` as this is owned by CSI-operator.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit c30b8a527b)
adding changes to create CSI-operator config CR based on
every radosnamesapce and subvolumegroup.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 667e044013)
adding code changes,rbac changes required for create the new
Ceph-CSI operator CR named cephCluster in api group 'csi.ceph.io'.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 4b0b3a55d9)
For the specification see:
<https://github.com/rook/rook/blob/master/design/ceph/object/swift-and-keystone-integration.md>
* extend the API object specs for swift and keystone integration
* adapt rgw to the new go-ceph version
- The parameter lists of the API call have changes, as parameters
ignored by the RGW Admin Ops API are no longer serialized, therefore
the mock has to be adapted.
- There is now validation for the user keys that are passed to the
User get API, therefore things failed when we had empty keys in our
User proxy object.
* expand the reconcile loop for the swift and keystone integration
* fix minor mistakes in design document
* add env var to pass extra args to minikube
Minikube decides CPU cores and memory automatically based on the
available resources on the machine which may be insufficient to
run rook. This commit adds an environment variable to add arbitrary
arguments to the minikube command, so both can be specified if
desired.
* integration tests for swift and keystone
The new integration of swift or s3 and keystone support by rook
does not have any integration tests yet.
This commit introduces integration tests for swift and keystone. The
tests are done against a minimal keystone setup (keystone container
image from Yaook-project (https://yaook.cloud), sqlite as database
backend, cert-manager and trust-manager for test certificate setup).
To prevent hardcoded credentials, passwords are generated
by the tests. The integration tests use the openstack client
(keystone- and swift-functionality) (https://docs.openstack.org/
python-openstackclient/ latest/). This was a concious design decision
to use client tooling as close as possible to the end user instead of
using other go-libraries (such as gophercloud).
* add documentation on swift and keystone
Currently there is no documentation on the use of Swift to access
an object store as well as the use of OpenStack keystone for
authentication.
This commit adds documentation on the use of Swift and OpenStack
keystone, as well as CRD-related documentation and an example setup.
* add integration tests for S3 via keystone
This commit introduces integration tests for s3 and keystone. The
tests are run against the same minimal keystone setup that the tests
for swift and keystone use.
The integration tests use the aws s3 client to use client tooling as
close as possible to the end user instead of using other go-libraries.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Co-authored-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Signed-off-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
(cherry picked from commit ee8bcad49d)
Add CephObjectStore spec.hosting.advertiseEndpoint configuration. This
provides a clear documented default for which endpoint Rook "advertises"
to dependent resources like CephObjectStores, OBCs, and COSI
Buckets/Accesses and allows users to override the default behavior if
desired.
The current default is to round-robin an endpoint from
spec.hosting.dnsNames, which has proven to be troublesome for some
users' object store configurations. This change provides much-needed
disambiguation for users.
This may be a breaking change for some existing spec.hosting.dnsNames
users. This is unexpected but is documented.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit a2b0b6449c)
Artem Torubarov
Blaine Gardner
Niraj Yadav
Madhu Rajanna
Travis Nielsen
Joshua Hoblitt
Michael Adam
subhamkrai
Artem Torubarov
Alexander Trost
rene
parth-gr
Zuhair AlSader
Justin Cichra
mergify[bot]
Praveen M
ShravaniVangur
Sebastian Riese
Rakshith R
sp98