When the csi-operator is enabled no need to update
the cm rook-ceph-csi-config configmap.
Otherwise operator will complain about the error
```yaml
ceph-cluster-controller: failed to reconcile CephCluster "rook-ceph/rook-ceph". failed to reconcile cluster "rook-ceph": failed to configure local ceph cluster: failed to create cluster: failed to start ceph monitors: failed to initialize ceph cluster info: failed to save mons: failed to update csi cluster config: waiting for CSI config map to be created: configmaps "rook-ceph-csi-config" not found
```
Signed-off-by: subhamkrai <srai@redhat.com>
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
Create a new OSD pod init container that loads the latest CephX key for
the OSD. The init container must be run after OSD activation, due to
keyfile reset behavior of ceph-bluestore-tool, used during activation.
The primary purpose of this work is to allow OSDs to start and run
correctly after key rotation, whether done manually by users or
automatically by future Rook work.
This work makes redundant prior code changes done in #14826. The CI test
added in the prior work is kept to ensure no regression.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
The rados namespace status was not reporting if the namespace
was empty. Now the condition will be properly updated if
it is empty.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
currently it was using two tabs, but
others config are using one tab
So update the config to use one tag
Signed-off-by: parth-gr <partharora1010@gmail.com>
currently nfs is used as the unique selector
for daemon id, which returns nfs: ocs-storagecluster-cephnfs-a
Updating the has() to function to check the same label value
(n.Name + "-" + id)
Signed-off-by: parth-gr <partharora1010@gmail.com>
this commit remove the code which sets the dmcrypt encryption
key from secret as environment variable in the prepare pod job
spec. Now, the env will be set under function `setKEKinEnv`, which
tries to reads secret from k8s first method `c.IsK8s()`under
`GetSecret` and then check for KMS to ready and apply env directly.
Signed-off-by: subhamkrai <srai@redhat.com>
update comment to correctly state that reconcilecephcluster
manages the cephcluster object, not cephfilesystem.
Signed-off-by: Oded Viner <oviner@redhat.com>
This change cleans up and standardizes import statements across the Ceph operator code. It removes redundant or duplicate imports and reorganizes alias names for improved clarity and consistency. Additionally, the ST1019 exception was removed from .golangci.yaml now that the code complies with the rule.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
This change adds support for skipping reconciliation of CephNFS daemons
that are labeled with `ceph.rook.io/skip-reconcile=true`.
Similar to MDS, MGR, and RGW components, this allows cluster operators
to prevent Rook from modifying specific NFS daemon deployments.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
Refactored multiple conditional if-else blocks into switch statements to improve readability and maintainability. Also removed outdated staticcheck rule comments (QF1002, QF1003) from .golangci.yaml.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
Labels cannot be longer than 64 characters, and if the image name
is too long we log a verbose message about the label that we can
just log now as debug level.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
when a reconcile returns a requeue result without an error
(e.g. due to a missing cephcluster), the previous logic reported
it as a successful reconcile. this was misleading and made it
hard to understand the actual controller behavior this
change adds a new condition to log and emit a "requeuing" event
when reconcileResponse.Requeue is true and err is nil.
this ensures more accurate event reporting and improves observability across
all controllers using reportreconcileresult.
Signed-off-by: Oded Viner <oviner@redhat.com>
The Kubernetes CSI sidecars have had several releases that were not
included in deployments by Rook yet, update them to the versions that
are available today:
- csi-attacher:v4.8.1
- csi-provisioner:v5.2.0
- csi-resizer:v1.13.2
- csi-snapshotter:v8.2.1
This change is important, because Ceph-CSI will implement the new
Controller.GetSnapshot CSI procedure. A bug in csi-lib-utils causes a
panic when a ControllerCapability is provided, but not (yet) known to
the CSI sidecars. The updated sidecars consume a version of
csi-lib-utils with a fix for that panic.
See-also: kubernetes-csi/csi-lib-utils#188
Signed-off-by: Niels de Vos <ndevos@ibm.com>
there can be a scenario where a new RNS CR is created with
the same spec.blockPoolName and spec.name, in that case we want to delete
the old RNS CR without checking dependent child resources.
Signed-off-by: subhamkrai <srai@redhat.com>
This PR sets CSI_ENABLE_METADATA to true by default in the
Rook configuration, ensuring that the --setmetadata=true
flag is added to CSI nodeplugin pods
Signed-off-by: Oded Viner <oviner@redhat.com>
there can be a scenario where a new svg cr is created with
the same svg.filesystem and svg.spec.name, in that case we want to delete
the old svg CR without checking dependent child resources.
Signed-off-by: subhamkrai <srai@redhat.com>
When monitoring is enabled, if the service monitor fails
creation, the reconcile will fail and rook will never
create the OSDs. A number of users have been blocked during
install due to this issue. Let's allow reconcile of the
full cluster even in this error case. After they install
prometheus, they would then need to trigger a reconcile again
perhaps by restarting the rook operator to enable
the service monitor.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With a osd resize operation, currently pvc and pv may
takes more time then expected.
And so the osd dont get resized and need manual re-start
as currently we don't have a watch on osd's
controller that watches pv and get it resized.
add a wait time till pvc is not resized
Signed-off-by: parth-gr <partharora1010@gmail.com>
When multiple `CephObjectStoreUser` CRs are present, the operator logs a
high volume of `CephObjectStore "foo" found` messages during reconcile.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
When a rados namespace is deleted, it cannot be purged
until its images and snapshots are deleted. Now a condition
is being added to the rados namespace CR status so the user
does not need to read the operator log to discover the cause.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
subham rai
Madhu Rajanna
subhamkrai
Oded Viner
Blaine Gardner
Kyori Sakao
Patryk Rostkowski
Santosh Pillai
Praveen Hosamani
parth-gr
Carlos Barria
Niels de Vos
Joshua Hoblitt