For all Rook-maintained GH actions, use a default shell that has xtrace
enabled to help debug any errors.
Enable xtrace on all actions except these that use only external tools:
- codespell
- commitlint (wagoid/commitlint)
- golangci-lint
- helm-lint (chart-testing)
- stale
- yamllint
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The operator has very bursty behavior while it is reconciling, then
has much lower resource requirements. We reduce the memory requests to 128Mi
while the limits remain at 256Mi. When not reconciling, the background
health operations are much less resource demanding.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In e8f9cfcb71, the logging was replaced by
Debug which is probably a mistake given the intent of the commit to
enable debug logging on the prepare job.
However, this code is only triggered when running a ceph-osd with the
rook binary, so we must run Info and run Debug since Debug is not
activated.
Signed-off-by: Sébastien Han <seb@redhat.com>
When evaluating the potential "warning" key from the json output we were
not hiding stdout (1) from the output, so the key was leaked. Also the
warning check for the key was not perfect, it only checked for the
command to succeed, but we should introspect it since the "warning" key
is always present unlike the "error" one.
We now only print the warning or the error is present.
Signed-off-by: Sébastien Han <seb@redhat.com>
In pkg/operator/k8sutil/network.go:ApplyMultus(), sort the string
annotations before applying them so that Rook will avoid the situation
where a Deployment or Pod will need updated repeatedly even when no
Multus network configuration has changed.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We have seen issues with fullchain.pem files containing one self-signed
certificate. At the same time, the failing configuration was not
providing any client certificates or keys.
The error from curl was `"self signed certificate in the chain"`.
The openssl binary is not available so we cannot even c_rehash the
certificate directory when using `--capath`, however this worked already
with a fully signed fullchain.pem along with a client certificate and
key. So we cannot only use `--cacert` which will break that use case.
This is becoming really obscur on why using `--cacert` solves this
problem. I just can't wait to use the `vault` binary, that's all I can
say...
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit moves SetParams and ValidateCSIParam func
into go routine/lock, since it modifies/reads global CSIParam
variable.
Signed-off-by: Rakshith R <rar@redhat.com>
For the TLS communication for AdminOps Api, httpclient is required and
filled with TLS certs, currently it is set to nil pointer in
`buckethealthchecker` and `cephobjectstoreuser`.
Thanks @Krast76 finding the issue even proposing the fix.
Fixes: #8132
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
When the mons are using the dataDirHostPath and not a volumeClaimTemplate,
they need to be permanently assigned to a node. The node assignment
was missing in stretch clusters when the dataDirHostPath was being
used. This resulted in mons that were moving to other nodes for example
during a node drain, which would cause the mon to lose its backing store.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Move MDS related information from the Cluster to the Filesystem document.
Document how resource requests influence Ceph configuration keys.
Signed-off-by: Pedro Lopes <paol@draic.org>
The helm doc example is more natural with the command to directly
create the namespace when needed instead of as a separate command.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cluster CR name defaults to the namespace where the CR is created.
This name may need to be overridden if the chart is taking over a
cluster that had been previously created with a different name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CephCluster CR for an existing cluster can be taken over by
the new cluster helm chart if desired, for simpler management
of the RBAC and other resources.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The active osd container was always using /var/lib/rook for the
configuration of the OSD. If the dataDirHostPath is anything other
than the default, the config would show up in the wrong place.
Changing this back to the dataDirHostPath does not appear to affect
any upgrade scenarios as the activate container will simply start
extracting the config to the correct place.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
we should not use --force when creating filesystem(fs)
as it will recreate fs which will leads to data loss
when `preserveFilesystemOnDelete` is set to 'true'.
this commit removes --force argument when create fs.
Signed-off-by: subhamkrai <srai@redhat.com>
Add ability to set device class for existing osd deployments,
based on its crush map device class.
Related-Issue: rook#8028
Signed-off-by: Denis Egorenko <degorenko@mirantis.com>
When there are two mgr daemons, a sidecar of the mgr will update the
service monitor depending on the active mgr daemon. When there is only
a single mgr, the operator will create the service monitor. Now, we
add rbac for the mgr to create these resources.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
Blaine Gardner
Sébastien Han
subhamkrai
Blaine Gardner
Andy Bursavich
Rakshith R
Jiffin Tony Thottan
Pedro Lopes
Denis Egorenko
Madhu Rajanna