Fix an issue where keepPriorKeyCountMax would be counted differently
when rotation was currently in progress, versus when rotation was not in
progress.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This PR implements the CSI cephx key rotation feature,
which follows overlapping rotation for non-daemon keys.
Refer to the cephx rotation API from design PR 15915 for details.
Signed-off-by: subhamkrai <srai@redhat.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
ceph-csi uses an exclusive lock for cryptfs operations. This needs the x capability on the metadata pool.
Fixes#15283
Signed-off-by: Felix Prasse <1330854+flx5@users.noreply.github.com>
in the existing node watcher, we'll check for node update
event and see if there are `out-of-service` taints are applied
and `ROOK_WATCH_FOR_NODE_FAILURE` is enabled in rook-ceph-operator-configmap,
if then we'll create the networkFence cr and delete the cr if nodes come back.
And, added the unit test too.
Signed-off-by: subhamkrai <srai@redhat.com>
If the kernel doesnt support mapping of
rbd image with deep-flatten feature,cephcsi
need to flatten the rbd image first and than
map the image on the node.
cephcsi first tries to add a task to flatten
the rbd image if its receives any permission
error it will try to call rbd CLI command which
is a blocking call.
This commit adds mgr caps to the csi-rbd-node user
so that cephcsi will add flatten task and return
immediate error to the kubelet, let kubelet retry
again,If we go with blocking rbd CLI call we may
end up having stale maps on the node in corner cases.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
dependabot[bot]
Blaine Gardner
parth-gr
subhamkrai
Madhu Rajanna
Felix Prasse
Riya Singhal
Sébastien Han