Linux doesn't guarantee file ordering, so when dealing with files in
order, we can use 'sort' to make sure the order is deterministic. For
yq's usage of files, we need to keep file names in an intermediate
variable, and this should be an array to support file paths with spaces.
'readarray' is not available on MacOS's built-in bash, so a longer
'while read' loop is needed for the array creation.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
When the active mgr changes, there may be user-created services
that also need to have their selector updated to point to the
new active mgr. Now the operator will update any service in the
rook operator namespace that has the label app=rook-ceph-mgr
to point to the active mgr.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The helm tests were previously only for new installs, and did
not have an upgrade path. Now the upgrade path is tested
to give confidence in the helm upgrades.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The test suites were triggered by Jenkins potentially
using different versions of K8s and environment variables.
There is no longer a need for these environment vars to
determine which test suites should be run. The test
suites to run can just be triggered directly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Previously we were using the namespace, it's a mistake, even though most
clusters use the same name as the namespace.
Let's be precise and use the cluster name when looking for it.
Signed-off-by: Sébastien Han <seb@redhat.com>
right now the RoleBinding for monitoring is created with the cluster namespace as the subject
this causes the operator to loop on reconcile due to it not having permissions to create monitors
in the other cluster
moving the subject to the operator namespace fixes this
Signed-off-by: Henry Zhang <me@henry.dev>
The colon character is not allowed in secret names, therfore the secret
with the subuser credentials must use another character to join the
user and the subuser name.
This in turn makes the mapping non-injective (which has security
implications).
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Make explicity how the operator acts when the subuser list in the
CephObjectStoreUser CR is changed.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Since only OpenStack Identity API version 3 is supported the
API version need not be configurable in the resource.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The local build tag replacement in the CI should work the same
whether in master or release branches, so we use a regex to
match any rook/ceph tag to be renamed to the local-build tag.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The info email list and rook-dev forum are targeted frequently by
spam and otherwise not used by the community. Let's focus on the
useful channels of slack, github, and security emails.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
As proposed in the review the natural target version for this feature is
1.9 which is to be released around March 2022.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The open questions have been resolved in the discussion and the chosen
solution has been added to the main text. So the Open Questions section
is obsolete now.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The goals/non-goals were mixed up to a degree. This
cleanly separates them to their respective sections.
In the course of that the term "Keystone API" was replaced by the more
correct "OpenStack Identity API" and the documentation of the API was
linked.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Rook needs to be able to watch all `ceph.rook.io` resources to reconcile
them; however, it does not need blanket verb privileges. Reduce the
privileges as much as possible.
Ideally, Rook would only have update permissions to status and
finalizers of resources; however, finalizers are not a full-fledged
subresource at this time, and "update" permissions must be maintained
for `ceph.rook.io` resources.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
Travis Nielsen
Sébastien Han
subhamkrai
Blaine Gardner
Sebastian Riese
Yuval Lifshitz
Henry Zhang
dependabot[bot]
parth-gr
Satoru Takeuchi