It has only been used by the flex driver which is long gone.
This removes the nodes/proxy RBAC grant from the helm chart, the example
YAMl and the security design docs.
Signed-off-by: Tobias Florek <me@ibotty.net>
since node fencing is disabled in rook for sometime
and this feature is implemented in csi. So, this
commits remove obsolete code related to node loss
Signed-off-by: subhamkrai <srai@redhat.com>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
Currently, when there are down OSDs but all PGs are clean we add the
number of downed OSDs ot the main PDB maxUnavailable. For example if
OSDs 1,3,5 are down and all PGs are clean we create the following PDB:
```yaml
maxUnavailable: 4
selector:
matchLabels:
app: rook-ceph-osd
```
This is potentially dangerous as there can be race conditions which can
break the cluster, for example:
1. A new node is added to the cluster with 4 OSDs
2. Those OSDs are down as they have not started up and joined the cluster yet
3. All PGs are healthy as the new OSDs haven't started yet and they are new
4. The rook operator sets maxUnavailable to 5 on the OSD PDB
5. The new OSDs move from down to up as they start
6. Something in the cluster starts a disruption (eviction request)
7. Any 5 OSDs can be disrupted as maxUnavilable is still 5 and the downed OSDs are now up
8. If the 5 disrupted OSDs contain all the replicas of a PG it will cause the PG to go down
To better protect from this scenario, we can instead exclude the downed
OSDs from the main PDB instead of adding to maxUnavailable.
```yaml
maxUnavailable: 1
selector:
matchExpressions:
- key: app
operator: In
values: ["rook-ceph-osd"]
- key: osd
operator: NotIn
values: ["1", "3", "5"]
```
This allows drains to still process when there are downed OSDs and PGs
are clean without allowing the non-downed OSDs to be disrupted.
Signed-off-by: Elias Carter <elias@dropbox.com>
Add a design doc to addres RFE #15904.
This design outlines important UX and implementation details for
achieving automated/assisted workflows for rotating CephX authentication
keys for Ceph daemons and other clients.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
With the new squid patch release, update the base
image, the docs, and the examples to all use the latest
stable Ceph release v19.2.3.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
One ore more OSDs can be down and PGs can still be active+clean (data
was rebalanced to other available OSDs). This PR sets
maxunavailable=1+downOSDs to allow one healthy to be drained.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Add a design for CephObjectStore to allow users to pass through Ceph
configs (e.g., `rgw_enable_apis`, `debug_rgw`) to the object store. This
design will help users set configs that they want for their environments
that aren't covered under Rook's umbrella of managed configs. This will
benefit users by allowing them to make use of rare RGW features that
Rook devs don't have ability to prioritize, as well as newly-released
RGW features that Rook devs haven't had time to plan API interfaces for.
This frees up Rook developers to focus effort on implementing APIs that
have integration benefits with Kubernetes or other resources and less
effort on simple configs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
With the v19.2.0 release being out for some time now,
update the default version to be deployed with Rook
as v19.2.0.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Given that Ceph Quincy (v17) is past end of life,
remove Quincy from the supported Ceph versions,
examples, and documentation.
Supported versions now include only Reef and Squid.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Existing OSD migration process is limited to updating the OSD backend store. This docs proposes
a more generic API for the OSD migration that will help with other scenarios as well.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
For the specification see:
<https://github.com/rook/rook/blob/master/design/ceph/object/swift-and-keystone-integration.md>
* extend the API object specs for swift and keystone integration
* adapt rgw to the new go-ceph version
- The parameter lists of the API call have changes, as parameters
ignored by the RGW Admin Ops API are no longer serialized, therefore
the mock has to be adapted.
- There is now validation for the user keys that are passed to the
User get API, therefore things failed when we had empty keys in our
User proxy object.
* expand the reconcile loop for the swift and keystone integration
* fix minor mistakes in design document
* add env var to pass extra args to minikube
Minikube decides CPU cores and memory automatically based on the
available resources on the machine which may be insufficient to
run rook. This commit adds an environment variable to add arbitrary
arguments to the minikube command, so both can be specified if
desired.
* integration tests for swift and keystone
The new integration of swift or s3 and keystone support by rook
does not have any integration tests yet.
This commit introduces integration tests for swift and keystone. The
tests are done against a minimal keystone setup (keystone container
image from Yaook-project (https://yaook.cloud), sqlite as database
backend, cert-manager and trust-manager for test certificate setup).
To prevent hardcoded credentials, passwords are generated
by the tests. The integration tests use the openstack client
(keystone- and swift-functionality) (https://docs.openstack.org/
python-openstackclient/ latest/). This was a concious design decision
to use client tooling as close as possible to the end user instead of
using other go-libraries (such as gophercloud).
* add documentation on swift and keystone
Currently there is no documentation on the use of Swift to access
an object store as well as the use of OpenStack keystone for
authentication.
This commit adds documentation on the use of Swift and OpenStack
keystone, as well as CRD-related documentation and an example setup.
* add integration tests for S3 via keystone
This commit introduces integration tests for s3 and keystone. The
tests are run against the same minimal keystone setup that the tests
for swift and keystone use.
The integration tests use the aws s3 client to use client tooling as
close as possible to the end user instead of using other go-libraries.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Co-authored-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Signed-off-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
RGW can only serve a single certificate. This limitation means that the
prior behavior of using the default service for admin ops when TLS is
enabled may mean it requires additional complex certificate management
to make sure the object store uses a certificate valid for Rook internal
admin ops and user connections.
This is needlessly complex for users. Instead, change Rook's behavior
and documentation to clarify that it will use the same endpoint intended
for S3 client applications. This means that users have a more
straightforward path to enabling both Rook and consuming applications.
More info: https://github.com/rook/rook/issues/14530
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Update the vhost-style S3 bucket access design doc to reflect recent
user feedback and configuration issues. The primary goal is to add a
field to disambiguate for users and Rook which endpoint should be used
for CephObjectStoreUsers, OBCs, and COSI buckets.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Until now, an object store would create all the necessary
metadata pools and the data pool that were exclusively
for its own object store. When isolation between object
stores is necessary, this would cause many pools and
PGs to be created in the cluster, which was not
manageable.
Now one set of pools can be created to be shared
by any number of object stores. The metadata and data
between each object store is isolated by
RADOS namespaces, which by design will keep the
data safe for multi-tenancy.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With the release of Reef v18.2.2 we update the default
recommended version of Ceph to fix the prometheus issues
seen with v18.2.1
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When CPU requests and limits are assigned to a pod,
the pod will be guaranteed the requests, up to the limits.
Even if there are spare CPU cycles, the pod cannot use
them. Thus, pods can be unnecessarily denied compute
when they need to burst if the limits are set.
Therefore, it is not recommended to set CPU limits
since the CPU requests are already guaranteeing that
no pod will be starved at least for its requests.
Signed-off-by: travisn <tnielsen@redhat.com>
Since v18.2.1 is the default recommendation for the ceph version,
update all the docs and examples to that version.
Signed-off-by: travisn <tnielsen@redhat.com>
This implements the "Ceph Config via Ceph Cluster CRD" design document
as a `cephConfig:` structure on the CRD.
This also fixes the `yq` commands used to manipulate the
`cluster-test.yaml` that caused CI issues for this PR and potentially
unknowingly others.
Signed-off-by: Alexander Trost <galexrt@googlemail.com>
This commits removes controller-runtime dependencies
from the apis dir and to achieve that we are removing
webhook.
Signed-off-by: subhamkrai <srai@redhat.com>
subham rai
Santosh
Tobias Florek
subhamkrai
Travis Nielsen
Deepika Upadhyay
Erik Sundell
Elias Carter
Blaine Gardner
Vilius Puškunalis
Anthony D'Atri
Emmanuel Ferdman
Artem Torubarov
Liang Zheng
Jiffin Tony Thottan
Alexander Trost