adds a new nvmeof minikube canary job for ceph v20.
the test deploys rook with csi operator disabled for nvmeof flow.
it validates pvc and pod io, gateway restart, and data persistence.
Signed-off-by: Oded Viner <oviner@redhat.com>
into a single combined integration-test-setup-cluster-resources
workflow. This ensures that the same gha runner preparation, go version,
etc. is used for both the canary and integration tests.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The two-object-one-zone canary test is not waiting
long enough for the cluster to be created. The default
timeout is 120s, and it frequently hits that timeout.
When the test passes, it commonly takes between 100-120
seconds to complete, so we just need to increase the
timeout.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The osd-with-metadata-partition-device canary test was always
running the version of ceph found in cluster-test.yaml,
instead of the intended version set for the canary tests to
run with in the ceph_images ci variable.
Thus we were seeing this test be more unstable when running
against ceph Tentacle.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This enables interactive debugging of ci checks
with the upterm tool as an alternative to the tmate tool which does not
work entirely anymore.
see https://github.com/rook/rook/issues/16131
addition to tmate, upterm debugging is now enabled via the debug-ci label on
PRs
Signed-off-by: Michael Adam <obnox@samba.org>
this commit add check to only run the csi-operator in
all the canary tests and upgrade suite only, other suite
like smoke and object will still test csi-driver.
Also, adding changes to make CI happy.
Signed-off-by: subhamkrai <srai@redhat.com>
Co-Authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
In canary test we install internal mode, first create keys with
generation=1
And then the exteranl mode test should run on generation=1,
as the script will detect the latest current generation=1
This also fix the canary test, which has started failing
Signed-off-by: parth-gr <partharora1010@gmail.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a new flag `--cephx-key-rotate` to rotate the
cephx keys genrated by external python script,
If we enable it, it will create a new user with suffix `.{x}`
Signed-off-by: parth-gr <partharora1010@gmail.com>
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
s3cmd can take more time to put the data
of 1M to the bucket as it waits for
connection to get established
currently ci fails with, Retrying failed
request: /test1-1mib-test.dat ([Errno 111]
Connection refused)
also increase the timeout for creating objectstore
Signed-off-by: parth-gr <partharora1010@gmail.com>
The rgw endpoint validation requires the zone flags to be passed
when the admin user is in a non-default zone.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The docker.io/rook/ceph image contains vulnerabilities in the s5cmd binary.
A new version of s5cmd was released on 16th December which resolves these issues.
Signed-off-by: TomHellier <me@tomhellier.com>
With the v19.2.0 release being out for some time now,
update the default version to be deployed with Rook
as v19.2.0.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add test to canary-integration-test scenarios which removes
osd auth and then recovers it on osd activation from keyring
file.
Resolves: #14825
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
`encryption-pvc-kms-ibm-kp` workflow replaces the name of ceph-image.
Since the dest value is always empty by mistake, this workflow
always fails.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Fix ceph image tag string passed to replica_ceph_image. Previously, the
result was "" was being passed in most cases.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
This acceptance test demonstrates the creation of two CephObjectStore(s)
that share the same pool(s) manually managed by CephBlockPool(s).
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Merge/inline.github/workflows/rgw-multisite-test/action.yml into
.github/workflows/canary-integration-test.yml as the step from the
"composite" action are not displayed in the console. The absence of the
step names may make it difficult to determine where a failure is
occurring.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Factor out most of the CRs used by various canary tests to a new
deploy_cluster_full_of_cruft_please_stop_using_this() function.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The openSSF scorecard report warns that the github workflows are not pinned by hash.
This PR aims at improving this by pinning the github workflows by hash.
Signed-off-by: harshitasao <harshitasao@gmail.com>
PR https://github.com/rook/rook/pull/14473
tried to improve the token-permissions score of the OpenSSF scorecard
report.
https://scorecard.dev/viewer/?uri=github.com/rook/rook
The latest scorecard run however shows that this score has not improved.
It still shows two warbnings about missing top level permissions.
The rest looks good (just Info entries).
This change aims at finally improving the token-permissions score
by adding top level permissions to the two warned-about workflow files.
Signed-off-by: Michael Adam <obnox@samba.org>
Now user can pass the cli flags using config file and
also command line argument,
if mentioned at both the place priority is given to
command line argument
Signed-off-by: parth-gr <partharora1010@gmail.com>
The test names must match exactly for the mergify
auto merge to complete successfully. Update two of
the test names to match the latest CI.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add new CSI_DISABLE_HOLDER_PODS option for rook-ceph-operator.
This option will disable holder pods when set to "true".
In the long term, Rook plans to deprecate the holder pods entirely.
This new option will allow users to choose to migrate their clusters to
non-holder clusters when they are ready and able, giving them time to
gracefully migrate before the holders are permanently removed.
This option is set to "false" by default so that upgrading users don't
have their CSI pods modified unexpectedly.
Example manifests are modified to set this value to true so that new
clusters will not deploy holder pods.
Migrating users are provided with documentation to instruct them about
the new requirements they need to satisfy to successfully remove holder
pods, a procedure for migrating pods from holder to non-holder mounts,
and a way to delete holder pods once they are no longer in use.
When users set CSI_DISABLE_HOLDER_PODS="true", the CSI controller will
no longer deploy or update the holder pod Daemonsets, but it does not
delete any existing Daemonsets. This allows already-attached PVCs to
continue operating normally with their network connection continuing to
exist in the current holder pod. This is critical to avoid causing
ia cluster-wide storage outage.
More info: https://github.com/rook/rook/issues/13055
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Until now, an object store would create all the necessary
metadata pools and the data pool that were exclusively
for its own object store. When isolation between object
stores is necessary, this would cause many pools and
PGs to be created in the cluster, which was not
manageable.
Now one set of pools can be created to be shared
by any number of object stores. The metadata and data
between each object store is isolated by
RADOS namespaces, which by design will keep the
data safe for multi-tenancy.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For nightly jobs, canary tests are all running with the same job IDs,
making the last-run jobs cancel previous runs. Add a workflow-id
parameter to canary jobs that can be used to give each job in a canary
suite a unique job ID to prevent this.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Oded Viner
dependabot[bot]
Joshua Hoblitt
Travis Nielsen
Michael Adam
subhamkraiandTravis Nielsen
parth-gr
Vilius Puškunalis
TomHellier
Peter Razumovsky
Blaine Gardner
Satoru Takeuchi
subham rai
Praveen M
harshitasao