OSDs are created with `ceph-volume lvm batch` if `metadataDevice`
field is specified in CephCluster CR. Since this command does not
support kernel names (e.g. `/dev/dm-X`) for multipath devices,
we should use real names (e.g. `/dev/mapper/mpathX`) instead.
NOTE:
I intentionally keep raw mode OSD creation code as is
because `ceph-volume raw prepare` supports kernel names
for any devices.
Closes: https://github.com/rook/rook/issues/17057
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
when the osd is created there is no need for
osd bootstrap keyring, so remove the keyring
and keyring file,
New keyring will be created if
new osd need to be provisoned
Signed-off-by: parth-gr <partharora1010@gmail.com>
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
This change refactors the getSecret method somewhat toward cleaner code.
The only additional change in behavior is the introduction of a switch instead
of multiple if's and error treatment of the case of an empty secret.
Signed-off-by: subhamkrai <srai@redhat.com>
During the OSD preparation step, if the encrypted OSD disk belongs to a
different cluster, then clean the disk if `wipeDeviceFromOtherClusters`
is set to true.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
this commit remove the code which sets the dmcrypt encryption
key from secret as environment variable in the prepare pod job
spec. Now, the env will be set under function `setKEKinEnv`, which
tries to reads secret from k8s first method `c.IsK8s()`under
`GetSecret` and then check for KMS to ready and apply env directly.
Signed-off-by: subhamkrai <srai@redhat.com>
Refactored multiple conditional if-else blocks into switch statements to improve readability and maintainability. Also removed outdated staticcheck rule comments (QF1002, QF1003) from .golangci.yaml.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
ceph-volume raw list will return the main disk instead of the mpath
setup. `ceph-volume lvm zap` on the main disks fails. This PR uses
`lsblk /mnt/<diskreference> ` to fetch the actual mapath disk and use it
for cleaning
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Resolves this warning:
WARN [runner/nolint_filter] Found unknown linters in //nolint directives: just configuration keys., value not credential
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The ci was using a pretty old version og golangci-lint.
This updates to the latest version.
Additionally, it silences some
gosec integer conversion overflow false positves
and fixes some real errors of this category
and string format errors found by golangci-lint, while at it.
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
currently device class and device type
labels were clubbed with eachother
create a seperate label, as these two labels
can be seperate
Signed-off-by: parth-gr <partharora1010@gmail.com>
we were adding the device class as the
disk rotational type, but device class
can be user defined, so if user has
added the device class, use that value
Signed-off-by: parth-gr <partharora1010@gmail.com>
Given that Ceph Quincy (v17) is past end of life,
remove Quincy from the supported Ceph versions,
examples, and documentation.
Supported versions now include only Reef and Squid.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When doing the clean-up of raw device OSDs, it was not taking metadata
and wal devices into account. This commit discover them via the output
of `ceph-volume raw list`, which is returning `device_db` and/or
`device_wal` if they are present.
After discovering the metadata and wal device it also clean them and
close the encrypted device if any.
Signed-off-by: Mathias Chapelain <mathias.chapelain@proton.ch>
While adding a new encryption key to slot 1
if there exists a key in slot 1 which is not
equal to the one we want to update it with,
we kill the slot and then add the new key to it.
While killing the slot, the existing code uses
the new key, which is not valid in such cases.
This patch modifies the code to use the key in
slot 0 (the one that we know works) to kill the slot.
Signed-off-by: Niraj Yadav <niryadav@redhat.com>
Reduce CRD size by removing some descriptions for things that
(a) are long, (b) are repeated, and (c) are commong kubernetes types.
Remove the `Status` field from VolumeClaimTemplates (a.k.a. PVCs) in
types.go to remove all unnecessary status-related fields.
Use `yq` to go through generated `crds.yaml` to strip out descriptions
for well-known k8s types that are long and repeated where we can't
remove them from types.go. This is mostly placement descriptions and
volumeSource descriptions.
The overall `crds.yaml` file is reduced to less than 60% of its original
size.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
Co-authored-by: Blaine Gardner <blaine.gardner@ibm.com>
Currently, when rook provisions OSDs(in the OSD prepare job), rook effectively run a
c-v command such as the following.
```console
ceph-volume lvm batch --prepare <deviceA> <deviceB> <deviceC> --db-devices <metadataDevice>
```
but c-v lvm batch only supports disk and lvm, instead of disk partitions.
We can resort to `ceph-volume lvm prepare` to implement it.
Signed-off-by: Liang Zheng <zhengliang0901@gmail.com>
The validation logic of checking the number of devices is
wrong when `metadataDevice` is set and `osdsPerDevice` > 1.
`len(cvReports)` is the expected number of OSDs and is
the number of specified data devices multiplied
by `osdsPerDevice`.
Closes: https://github.com/rook/rook/issues/13637
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
create the ceph config and keyring file in the osd prepare pod
before starting the OSD migration. These files are needed to
run any ceph command.
Signed-off-by: sp98 <sapillai@redhat.com>
Adding callback function in the osd removal method
as in downstream there is requirement of adding extra
check before proceeding with osd removal.
Signed-off-by: subhamkrai <srai@redhat.com>
This reverts commit 093125904b.
Once we introduced encrypted OSD on partition in #12924.
However, even though `encryptedDevice` field is `true`,
an non-encrypted OSD is created. To prevent the creation
of misconfigured OSD, it's better to revert #12924 for now.
Initially, I intended to correct this problem. However, I found
it will take long time because we need to change the KMS-related
code, init containers of both OSD pod and OSD prepare pod.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
If osd store is updated in the ceph cluster, then
delete OSDs one by one, cleanup disks and provision a new OSD on
the same disk
Signed-off-by: sp98 <sapillai@redhat.com>
The vault server dependencies were pulling a lot of indirect modules
that are not necessary for Rook. The modules were only used
for testing. The vault github explicitly indicates that:
"Some other projects have made a practice of doing so in order to
take advantage of testing tooling that was developed for testing Vault itself.
This is not, and has never been, a supported way to use the Vault project."
When attempting to update to vault v1.13.3, we are hitting
such an unsupported configuration with go modules
that are impossible to satisfy. By removing the tests
that were using the vault server project, we can remove
this large set of dependencies, enable updating to v1.13.3,
and also reduce the modules pulled in by vault.
Signed-off-by: travisn <tnielsen@redhat.com>
The go modules are updated to the latest client-go, vault,
and other modules. There does not appear to be a combination
of modules that will allow us to use vault v1.13.3, so we
stick with v1.13.2.
Signed-off-by: travisn <tnielsen@redhat.com>
this feature is to allow the use of filters using the deviceFilter flag
by skipping devices that do not match the filter
Closes: #10340
Signed-off-by: Javier <sjavierlopez@gmail.com>
Satoru Takeuchi
Jongwoo Han
huyejia
Santosh Pillai
parth-gr
Vilius Puškunalis
Kyori Sakao
Travis Nielsen
subhamkrai
Blaine Gardner
Carlos Barria
Joshua Hoblitt
Praveen M
Mathias Chapelain
Niraj Yadav
Brian Dowling
clonefetch
Redouane KachachandBlaine Gardner
Liang Zheng
guoguangwu
Javier