The upgrade function doesn't seem to be that smart
for now so it can update the new auth caps listed
with the existing one, it only compares the value of
the current cap with the MIN_USER_CAP_PERMISSIONS,
Modified the upgrade flag functionality so we can use
this while upgrading the cluster clients
Closes: https://github.com/rook/rook/issues/9589
Signed-off-by: parth-gr <paarora@redhat.com>
```
ReadWriteOnceWithFSType: Indicates that volumes will be examined
to determine if volume ownership and permissions should be modified
to match the pod's security policy. Changes will only occur if the
fsType is defined and the persistent volume's accessModes contains
ReadWriteOnce.
```
In between considering we are giving 0777 permission on nodestage
of cephfs shares, we defaulted to NONE. However giving worldwide
permission to the volume is not the right thing and it has been
fixed in cephfs via https://github.com/ceph/ceph-csi/pull/2847
This commit brings it back to the value which is also in parity
with RBD driver.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
updating the csi-snapshotter and dependencies
to v5.0.1 released version.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This patch brings a mechanism to define arbitrary environment
variables in OSD containers (both prepare and main ones).
It bases on idea proposed by Sebastien Han to use an optional
`ConfigMap` instance named `aook-ceph-daemon-env-override`
as the source of these settings.
The need for the patch comes from the fact that, although
crimson finally exposes the same CLI interface as the classical
OSD, the broadly used development builds have ASan built in.
As ASan, by default, complains if it isn't the very first loaded
DSO, we need a way to set the `ASAN_OPTIONS` environment variable
to `verify_asan_link_order=0` to mitigate the early aborts.
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
Recent versions of helm are failing the linter on the end tag
if the tag is "{{- end -}}". Instead, the correct end tag
is "{{- end }}".
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit updates the csi-addons image version
from v0.1.0 to v0.2.1.
Also, this updates the staging path from
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/pv/ to
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/.
This changes is done as the reclaimspace on block mode
was not working.
For more details:
https://github.com/csi-addons/kubernetes-csi-addons/pull/97
Signed-off-by: yati1998 <ypadia@redhat.com>
Some operator settings can be applied dynamically in a configmap
instead of requiring the operator to restart. While these settings
may be infrequently updated, applying these settings in the configmap
can avoid an unnecessary operator restart. This will also make the
operator deployment more consistent with the non-helm install.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit restrict csiaddons to open only 1 port
as per the requirement which is required for security.
Fixes: #9604
Signed-off-by: yati1998 <ypadia@redhat.com>
add annotations to secrets and configmaps to use
different tools to sync secrets and configmap.
Currently, these annotation is applied only on
the `rook-ceph-mon-endpoints` configmap and
the secrets `rook-ceph-mon` and `rook-ceph-admin-keyring`.
Closes: https://github.com/rook/rook/issues/8999
Signed-off-by: subhamkrai <srai@redhat.com>
Even though mention about keda 2.x version, the scaledObject.yaml or
rgw-keda.yaml referring to older keda CRs
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The CSI users created by the external script(both for rbd and cephfs)
need the blocklist capability so the CSI pods can execute the
`osd blocklist` commands for metro DR
update the mon caps of csi users with `profile simple-rados-client-with-blocklist`
so they have privileges to run osd blocklist cmds
Closes: https://issues.redhat.com/browse/RHSTOR-2451
Signed-off-by: parth-gr <paarora@redhat.com>
Below sidecars are updated to the latest releases with this commit.
csi-provisioner : 3.1.0
csi-attacher : 3.4.0
node-driver-registrar: 2.4.0
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
right now the RoleBinding for monitoring is created with the cluster namespace as the subject
this causes the operator to loop on reconcile due to it not having permissions to create monitors
in the other cluster
moving the subject to the operator namespace fixes this
Signed-off-by: Henry Zhang <me@henry.dev>
Rook needs to be able to watch all `ceph.rook.io` resources to reconcile
them; however, it does not need blanket verb privileges. Reduce the
privileges as much as possible.
Ideally, Rook would only have update permissions to status and
finalizers of resources; however, finalizers are not a full-fledged
subresource at this time, and "update" permissions must be maintained
for `ceph.rook.io` resources.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
Recently with the directory renaming to "deploy/olm" the CSV name
changed from "ceph" to "olm". Now we are using the same "rook-ceph" name
regardless of the platform.
Signed-off-by: Sébastien Han <seb@redhat.com>
Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
The label was on the job, but not on the pod template,
so querying for the pod logs was not working as simply
as if we added the label.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job
creating pods under PSP-enabled Kubernetes cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
parth-gr
subhamkrai
Humble Chirammal
Travis Nielsen
Mathieu Parent
Madhu RajannaandMathieu Parent
Radoslaw Zarzynski
yati1998
Blaine Gardner
Satoru Takeuchi
Sébastien Han
Jiffin Tony Thottan
Yuval Lifshitz
Henry Zhang
Daniel Ruiz Capilla
Yuichiro Ueno