In the Alpha Version of the VolumeGroupSnapshot
Feature the flag to enable the feature was
`--enable-volume-group-snapshots=true` and in the beta
API the feature is diasbled by default to enable it
we need to set `--feature-gate=CSIVolumeGroupSnapshot=true`
There is a change in the flag between the API version
This PR add a code where we choose the required
flag based on the API version.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.
5.2.8 Minimize the admission of containers with added capabilities
Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.
5.7.3 Apply Security Context to Your Pods and Containers
When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
deployments on openshift where we need csi container pods
to be run on privileged, the logrotate sidecar container was missing the
privileged permission letting, side car to not run properly
Signed-off-by: parth-gr <partharora1010@gmail.com>
issue:
external-provisioner (v5) enabled topology feature-gate by default
and the current implementation in Rook uses a conditional block to
enable the topology feature gate. This approach now does not directly
reflect the state of the `CSI_ENABLE_TOPOLOGY`.
fix:
replacing the conditional block with a direct use of the
`CSI_ENABLE_TOPOLOGY` for flag value.
Signed-off-by: Praveen M <m.praveen@ibm.com>
This commit adds the flexibility to configure kube apiserver qps
as per the user requirement and also keeps the existing values as
the default one.
Signed-off-by: yite.gu <yitegu0@gmail.com>
Use the same logrotate flow of rbd, as merged in #14305
1) Make the csi cephfs and nfs container logs persisted in a file
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
And some fixes on the implementation:
1) Add a operator namespace in the log file path
2) Only add volume to the container if logrotate is enabled
Closes: https://github.com/rook/rook/issues/12809, https://github.com/rook/rook/issues/14429
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the recent enhancements csi containers for using
logrotate, they need to run with securityContext to privileged,
on platform like openshift.
Used the ROOK_HOSTPATH_REQUIRES_PRIVILEGED flag
wich is set with operator deployment to see
if the securityCOntext is needed or not
Closes: https://github.com/rook/rook/issues/14400
Signed-off-by: parth-gr <partharora1010@gmail.com>
1) Make the csi rbd container logs persisted in a file
(csi plugin, csi provisioner, csi addons sidecar)
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
part-of: https://github.com/rook/rook/issues/12809
Signed-off-by: parth-gr <partharora1010@gmail.com>
volumegroupsnapshot feature will be enabled
by default if the required CRD's are present
if not its disabled and user will have an option
to disable it if they dont require this feature.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit removes the `CSI_ENABLE_READ_AFFINITY` since
it is no longer utilized after addition of the read affinity
option per cluster via CSIDriverSpec.
Signed-off-by: Praveen M <m.praveen@ibm.com>
This commit adds the flexibility to configure
leader election flags as per the user
requirement and also keeps the existing values
as the default one.
resolve: #13475
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
GRPC metrics got deprecated in cephcsi
3.7.0 and the deprecated flags will get
removed in the next release. This PR
removes the deprecated metrics code which
allow us to run with older cephcsi as well.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
adding drop `ALL` capabilities in rook operator container
as this is not required and will remove warning in ocp cluster.
Signed-off-by: subhamkrai <srai@redhat.com>
This commit removes k8s version check for oidc token
which required k8s v1.20 or above since minimum
k8s version that rook supports now is v1.22.
Signed-off-by: Rakshith R <rar@redhat.com>
adding a option to make AttachRequired field
as configurable and added a comment to explain
the consequences of changing the default value
resolves: #11805
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit adds code to supply variables required
to enable read affinity for rbd volumes.
It leverages `read_from_replica=localize,crush_locations=key:value`
krbd map option from ceph to serve reads from the most local OSD.
refer:
https://docs.ceph.com/en/latest/man/8/rbd/#kernel-rbd-krbd-options
Signed-off-by: Rakshith R <rar@redhat.com>
The default value of maxUnavailable of daemonset is 1.
Sometimes the upgrade can be slow due to this setting.
So I add a parameter to change the value for rbd daemonset.
Signed-off-by: Shinya Hayashi <shinya-hayashi@cybozu.co.jp>
Co-authored-by: Toshikuni Fukaya <toshikuni-fukaya@cybozu.co.jp>
Co-authored-by: Yuji Ito <llamerada.jp@gmail.com>
The omap generator sidecar is the one who
sets the pvc name and clustername in the metadata
if the pv is re-attached to a new pvc or if the
clustername changes, for that reason we need to
set these flags on the omap generator sidecar
also.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Introduce a new env variable ROOK_CSI_IMAGE_PULL_POLICY in rook operator configmap which should be used to
customize the imagePullPolicy for the csi driver and imagePullPolicy property in cephVersionSpec for ceph pods.
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
This commit adds topology provisioning
support. This makes modification to rbac,
csi deployment and daemonset.
Signed-off-by: Rakshith R <rar@redhat.com>
This commit removes controller-ip parameter from
csi-addons sidecar as it is no longer required to be
passed.
Signed-off-by: yati1998 <ypadia@redhat.com>
The volume replication operator is being moved to
kubernetes-csi-addons. This commit hence, removes
the volume replication sidecar and updates the
related documentation.
It will also update the csi-addons sidecar version
to the latest one.
Closes: #10655
Signed-off-by: yati1998 <ypadia@redhat.com>
One can now use the operator configmap for CSI_CLUSTER_NAME variable
for setting ClusterName on the RBD images and CephFS subvolume.
This will be useful in cases like for example, when two container orchestrator
clusters (Kubernetes/OCP) are using a single ceph cluster.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
One can now tweak the operator configmap for CSI_ENABLE_METADATA boolean to
enable/disable setting of PV/PVC/PVCNamespace &
snapshot-name/snapshot-namespace/snapshotcontent-name on the RBD images
and CephFS subvolume.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
This commit introduces new log level called csidecarLogLevel
for the sidecars which are not maintained by the csi-driver.
This will allow to have different configuration options
for the sidecars like snapshotter, resizer, attacher and
provisioner containers which will help to avoid the
spamming of logs to an extent.
Signed-off-by: yati1998 <ypadia@redhat.com>
A Liveness sidecar container that is deployed
with the CSI pods will be helpful to check
csi driver is properly responding or not.
and there is no liveness or readiness
kubernetes probe added for this one.
Providing an option to enable this
sidecar deployment and disabling it by default.
fixes#8783
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
csi pods uses leader election and they were using
default values but seems like default values of leader
election are not working for some specific clusters.
Signed-off-by: subhamkrai <srai@redhat.com>
Kubernetes 1.24 and newer use a different path for staging the volume.
That means the CSI-driver is requested to mount the volume at an other
location, compared to previous versions of Kubernetes.
The backward compatibility should be taken care by the CSI driver.
See-also: kubernetes/kubernetes#107065
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
If csi is configured not the use the
hostnetworking, deploy the holder
pod for executing the commands with nsenter.
The implementation is same as multus.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This argument in csi-provisioner and csi-snapshotter sidecar allows us
to receive additional metadata in the CreateVolume and CreateSnapshot()
request.
For ex:
as part of CreateVolume request:
csi.storage.k8s.io/pvc/name
csi.storage.k8s.io/pvc/namespace
csi.storage.k8s.io/pv/name
and
as part of CreateSnapshot request:
csi.storage.k8s.io/volumesnapshot/name
csi.storage.k8s.io/volumesnapshot/namespace
csi.storage.k8s.io/volumesnapshotcontent/name
This is useful information which can be used depend on the use case we have
at our csi driver level. The features like adding metadata to CephFS subvolume,
RBD image or snapshot can consume this based on the need.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
setting the GRPC timeout configurable helps
in some cases where ceph cluster takes more time
to respond.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Ceph-CSI supports LUKS encryption for RBD volumes.
This commit adds support for the same by adding capability
of mounting required `rook-ceph-csi-kms-config` configmap
into csi-rbdplugin-provisioner and nodeplugin pods.
Required documentations, helm charts and examples yamls
are also updated.
Resolved: #7032
Signed-off-by: Rakshith R <rar@redhat.com>
This oidc-token is used to authenticate with OpenID Connect (OIDC)
Provider. Currently, Ceph-CSI uses it to assume role with amazon STS
to get access to aws kms for encryption.
Signed-off-by: Rakshith R <rar@redhat.com>
Currently, the admin/user can configure the ceph.conf
for daemon pods using https://rook.io/docs/rook/v1.7/
ceph-advanced-configuration.html#custom-cephconf-settings.
This the above custom ceph.conf is only for ceph pods.
the support to provide constom ceph.conf for cephcsi
is added in cephcsi PR 2476
This PR adds the support to create/update
ceph.conf for csi pods.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit updates the csi-addons image version
from v0.1.0 to v0.2.1.
Also, this updates the staging path from
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/pv/ to
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/.
This changes is done as the reclaimspace on block mode
was not working.
For more details:
https://github.com/csi-addons/kubernetes-csi-addons/pull/97
Signed-off-by: yati1998 <ypadia@redhat.com>
CL0Pinette
Skala Networks
Madhu Rajanna
Peter Razumovsky
Blaine Gardner
parth-gr
Praveen M
Travis Nielsen
yite.gu
parth-gr
Niels de Vos
subhamkrai
Rakshith R
Humble Chirammal
Avan Thakkar
yati1998
Prasanna Kumar Kalever
Sébastien Han