Create a new OSD pod init container that loads the latest CephX key for
the OSD. The init container must be run after OSD activation, due to
keyfile reset behavior of ceph-bluestore-tool, used during activation.
The primary purpose of this work is to allow OSDs to start and run
correctly after key rotation, whether done manually by users or
automatically by future Rook work.
This work makes redundant prior code changes done in #14826. The CI test
added in the prior work is kept to ensure no regression.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
When force-deletion annotation is added to CephRadosNamespace CR, then
blocklist any watchers on the Namespace images in order to remove the
image from the trash
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
This improves the guide for deploying ceph clusters with helm
from development builds.
The missing piece was deploying the operator chart before the cluster
chart. The operator chart is needed as it installs the CRDs
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
This change refactors the getSecret method somewhat toward cleaner code.
The only additional change in behavior is the introduction of a switch instead
of multiple if's and error treatment of the case of an empty secret.
Signed-off-by: subhamkrai <srai@redhat.com>
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
The rados namespace status was not reporting if the namespace
was empty. Now the condition will be properly updated if
it is empty.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Previously, only the rook-ceph operator chart was linted in the CI.
With this change, the rook-ceph-cluster chart is linted additionally.
for developer convenience, The linting is realized via a new make target
'helm.lint'that can easily be invoked locally if the chart-testing tool
'ct' is available.
Fixes: #15966
Signed-off-by: Michael Adam <obnox@samba.org>
There are image create,delete,map
and unmap functions added very long back
when Rook was supporting flex driver. As
we dont have support for it and Rook doesnt
create or map rbd images. Moving the dead
code from the repo.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This change clarifies the description of the test environment in the
contributing guide with respect to the installation of helm.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
The script tests/scripts/helm.sh was previously used by some ci
workflows to install helm.
Now that this is not used anymore, this change removes the script.
Signed-off-by: Michael Adam <obnox@samba.org>
During the OSD preparation step, if the encrypted OSD disk belongs to a
different cluster, then clean the disk if `wipeDeviceFromOtherClusters`
is set to true.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This change returns the use of nested if clauses
instead of `and` function shortcut to avoid errors
in older helm versions.
Signed-off-by: Artyom Babiy <artyom.babiy@gmail.com>
In #15961 I updated the rgw docs, but I was looking at the published
docs and the bulleting is broken now for Gateway Settings. When I was
working on the PR I was just using the markdown preview in my editor and
wan't using the `docs-preview` target. It turns out that the markdown
editor and mkdocs render things differently.
This PR fixes the bullet formatting and I verified the fix by running
`make docs-preview` on my box and double checking the local website.
Signed-off-by: Elias Carter <elias@dropbox.com>
Travis Nielsen
Deepika Upadhyay
Blaine Gardner
subham rai
Santosh Pillai
Michael AdamandTravis Nielsen
subhamkrai
Patryk Rostkowski
dependabot[bot]
Liang Zheng
Oded Viner
Madhu Rajanna
Satoru Takeuchi
parth-gr
Artyom Babiy
Elias Carter