Due to multi-site Ceph object resources (realms, zonegroups, zones)
reconciliation CLI commands being proxied through CephCluster's Mgr pods
in Multus-based scenarios, return codes were being additionally wrapped
by K8S' command streams and weren't adequately handled in-code, causing
reconciliation of CephObject(Realm|ZoneGroup|Zone) resources to fail, as
an exit code of 0, instead of the expected syscall.ENOENT (2) was returned.
Fixes#12833
Signed-off-by: zer0def <zv0uzqbqnncivw0afjsx79jmd19shpps3r5f2vjc6yv@definedaszero.xyz>
Fix an issue in the network address detection job where placement was
only retreived from osd and not merged with all.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Use K8s LivenessProbe mechanism to check OK-status of nfs-ganesha
container. A user may define his own lineness-probe, or a default one
which expects NFS TCP-port 2049 to be active; that is, willing to accept
new connections: for Ceph>=18.2.1 issue 'rpcinfo' call on local pod;
otherwise use standard K8s TCP-socket liveness probe mechanism.
Define permissive values to liveness-probe to ensure that the NFS
service is defined in failed-state only when it has non-recoverable
error.
The current default definition of LivenessProbe is expected to guard the
nfs pod from at least the following two cases:
- Deadlocks: where an nfs-ganesha server is running, but unable serve
new connections due to internal bad-state.
- Resource exhaustion on the host node (e.g. OOM) which prevents the
server from accepting new connections and reply to NULL RPC request.
In both cases we expect K8s to reschedule the nfs pod, most likely on
different host node.
Refs rook issue #12719
Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Allow end-user to have full control on NFS-Ganesha liveness probe:
- Disabled
- Enabled, using user-provided definition
- Enabled, using Rook's default liveness probe for Ganesha.
Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Use the Rook image (defined by the operator pod) to detect the Multus
network address ranges. It is reasonable for users to want to have a
minimal Ceph image that does not have the `ip` utility installed, which
is used for detecting the address ranges of multus interfaces. Instead,
use the Rook image, which Rook can ensure has the `ip` tool if Ceph ever
removes it from their image.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This reverts commit 093125904b.
Once we introduced encrypted OSD on partition in #12924.
However, even though `encryptedDevice` field is `true`,
an non-encrypted OSD is created. To prevent the creation
of misconfigured OSD, it's better to revert #12924 for now.
Initially, I intended to correct this problem. However, I found
it will take long time because we need to change the KMS-related
code, init containers of both OSD pod and OSD prepare pod.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
GRPC metrics got deprecated in cephcsi
3.7.0 and the deprecated flags will get
removed in the next release. This PR
removes the deprecated metrics code which
allow us to run with older cephcsi as well.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The merge of the go modules in the apis subdirectory
missed some changes from another merge around the same
time, so this will add the missing updates and
fix the CI.
Signed-off-by: travisn <tnielsen@redhat.com>
when creating networkFence, rbd command was loading
admin config and hence running rbd command use client.admin
in case of external cluster also. With this commit instead
of client.admin user it will use what is being passed to
config.
Signed-off-by: subhamkrai <srai@redhat.com>
To keep the go dependencies minimal, add the go packages
just for the pkg/apis directory. Projects that only reference
the rook apis can then have a smaller footprint for Go
dependencies.
Signed-off-by: travisn <tnielsen@redhat.com>
In Reef the is_master changed from a string to a bool
so we must update the type for proper json
serialization.
Signed-off-by: travisn <tnielsen@redhat.com>
This reverts commit fab23d3407.
The mgr requires rw access for the cron job that collects
the crashes.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
As seen in https://github.com/rook/rook/issues/1988, it's a common
mistake to configure rook nodes with names that don't match Kubernetes's
node label. This PR prints more detailed message to help debugging
problem.
Signed-off-by: Bin Wang <bin.wang@mail.binwang.me>
Add break according to review comment
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Update log message according to review comment
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Currently, the function receives a single namespace string and appends
it to the users. This approach is insufficient when dealing with
multiple CephClusters running in different namespaces, as there will be
only one SCC. This update modifies the function to create users for all
specified namespaces, ensuring compatibility with multiple namespaces.
Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
There are 2 cases of randomly generated secrets copied into Rook's unit
test code that have been flagged by Gitleaks. Add a comment to both
cases to help the tool understand that these aren't real production
secrets -- just unit test stand-ins.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The /tmp dir is not always available in some environments.
The only directories the operator should rely on
are the directories that are in its pod spec.
For assimilate-conf now we use the /var/lib/rook
directory to generate files since we know it is
a valid emptydir mounted into the operator pod.
Signed-off-by: travisn <tnielsen@redhat.com>
If mountinfo path is available cephcsi will
try to recover the fuse client. adding the
support for the same in Rook.
fixes: #13009
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
From the Go specification [1]:
"1. For a nil slice, the number of iterations is 0."
"3. If the map is nil, the number of iterations is 0."
`len` returns 0 if the slice or map is nil [2]. Therefore, checking
`len(v) > 0` before a loop is unnecessary.
[1]: https://go.dev/ref/spec#For_range
[2]: https://pkg.go.dev/builtin#len
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Add the ability to specify node profiles in the multus validation test.
This addresses a few points of early feedback on the validation tool.
Statements below critique the tool's behavior before this patch.
1. The tool assumes all daemons are on public and cluster network, which
means users who have a significantly smaller cluster net (a
design choice) cannot run a single test to determine if Rook is
likely to install correctly.
2. The tool does not have placement options to select only a subset of
Kubernetes nodes to run validation on.
3. Users of multus seem to have a dedicated pool of storage nodes more
often than the average Rook install. This makes sense for security-
and perforance-minded users. The tool cannot run a single test to
verify storage-only and general-workload nodes at one time.
These points are addressed by allowing users to specify configurations
for different "NodeTypes."
Each NodeType config has options for selecting the number of OSDs as
well as the number of other (non-OSD) Ceph daemons. This limits the
unnecessary exhaustion of cluster network addresses from critique 1.
Each NodeType config has its own placement (critique 2).
Users can define as many NodeTypes as needed to test the network for
their planned CephCluster. Specifically, this allows the tool to test
storage-only nodes and generalized-workload nodes at the same time. An
arbitrary number of NodeTypes are allowed to support even more highly
specialized cluster setups, such as multiple tiers of storage nodes
where some storage-only nodes may run more OSDs than others.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
zer0def
dependabot[bot]
Travis Nielsen
parth-gr
Blaine Gardner
subhamkrai
Shachar Sharon
Redouane Kachach
Satoru Takeuchi
Madhu Rajanna
Sheetal Pamecha
sp98
Bin WangandTravis Nielsen
Nitin Goyal
Eng Zer Jun