rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the ceph exporter daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
rotate cephx keys based on keyRotationPolicy
and update cephxStatus for the crashcollector
daemon pods.
Signed-off-by: parth-gr <partharora1010@gmail.com>
Implement automated CephX key rotation for OSDs.
OSDs have marshalled CephX statuses applied as an annotation on the OSD
pod spec, which differs from other Rook Ceph daemons for a two reasons:
A large cluster could have hundreds or thousands of OSDs, so it is more
critical that Rook avoid rotating OSD keys more than once in the event a
CephCluster reconcile restarts partway through OSD creation/updation.
OSDs do not have their CephX keys stored in K8s Secrets, whose resource
version is used for enforcing the desired restart behavior other daemon
pods like RGWs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add RecoverAndLogException() helper to log panics with stack trace.
added defer call in all rook controller Reconcile() methods for
better error visibility in operator logs
Signed-off-by: Oded Viner <oviner@redhat.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the subvolume group.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Providing an option for user to specify the clusterID
they want to use in the storageclass while creating
the radosnamespace.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This PR implements the CSI cephx key rotation feature,
which follows overlapping rotation for non-daemon keys.
Refer to the cephx rotation API from design PR 15915 for details.
Signed-off-by: subhamkrai <srai@redhat.com>
Improves error handling when `updatestatus` function is called in
Filesystem controller. Retry logic is added incase of any conflicts and
update error is handled.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Rotate cephx keys for all the MDS daemons based on the cephxConfig in
teh cephCluster CR. Update the cephxStatus in the cephCluster CR and
cephfileSystem CR.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
This change updates the codebase to replace the deprecated
v1.Endpoints API with discoveryv1.EndpointSlice.
The v1.Endpoints API has been deprecated in Kubernetes v1.33+
Signed-off-by: subhamkrai <srai@redhat.com>
fixes a nil pointer dereference in GetProbeWithDefaults when
startupProbe is set in cephfilesystem and currentProbe is nil.
adds panic recovery in cephfilesystem reconcile loop to improve
error visibility and avoid silent reconcile restarts.
Signed-off-by: Oded Viner <oviner@redhat.com>
Ceph has a new ceph auth rotate command currently
present in ceph:main
Add a cephclient api support to rotate the
cephx keys genrated by cephclient
Signed-off-by: parth-gr <partharora1010@gmail.com>
When a mon is failed over, the old mon is left in mon quorum
until the new quorum is confirmed in quorum. When host networking
is enabled, this may result in two mons being in quorum with the
same ip, if the new mon is scheduled on the same node as the
down mon. This results in daemon crashes in the cluster since
they are confused by multiple of the same ip in the mon map.
The solution is to avoid scaling down the bad mon when host networking
is enabled. This will ensure the new mon is not scheduled on the
same node as the previous mon. With host networking, either another
node is necessary or the original mon must come back online to
restore quorum.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
currently, we're setting the env `DISCOVER_DAEMON_UDEV_BLACKLIST`
in operator.yaml but we're not reading from the operator env and
setting the value to discover pod env.
Signed-off-by: subhamkrai <srai@redhat.com>
If the node for an OSD does not exist within kubernetes, the PDB
reconciliation logic will fail to make progress. This can be problematic
as new OSDs added to the cluster may not be protected by OSD PDBs after
they are added since the PDB reconcilation logic is failing.
The solution is to treat non existing OSD nodes as drained which is
logically consistent with treating unschedulable OSD nodes as drained as
you cannot schedule a pod onto a node which does not exist.
Fixes: #16086
Signed-off-by: Elias Carter <elias@dropbox.com>
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
If RemoveSecret is set remove the secret.
if not set, do below
check if the current cephClient is owner if
secret is present, if not return as its owned
by other controller, if its not present create
or update the secret.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Travis Nielsen
parth-gr
Santosh Pillai
dependabot[bot]
chentao.2022
Blaine Gardner
Oded Viner
José Martínez
Madhu Rajanna
subhamkrai
Artem Torubarov
Elias Carter
raaizik
Muhammad Adil Ghaffar