OpenShift environment requires privileged containers when interacting
with the host filesystem, typically via dataDirHostPath.
The init container that changes the ownership of dataDirHostPath was
missing the privileged flag and users were getting permission denied
errors on the chown command.
Fixes: https://github.com/rook/rook/issues/3485
Signed-off-by: Sébastien Han <seb@redhat.com>
At the beginning of every container startup we now change the ownership
of every known ceph directories to ceph:ceph.
This will allow daemons to start properly as well as allowing daemon to
writes their logs on files.
This is needed because ceph daemon now run as 'ceph' instead of 'root'
Signed-off-by: Sébastien Han <seb@redhat.com>
Add Rook-Ceph PSP requirements to the `common.yaml` file. This is
commented for users to inspect and make informed decisions about their
own clusters just as with the rest of the file. For user clusters
without pod security policies enabled, this part of the config will be
a don't-care and not harm anything.
Because the PSP setup is now codified in `common.yaml`, it is no longer
necessary to have documentation for pod security policies, and the
`Documentation/ceph-psp.md` file is deleted.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
With the storage providers growing, we should make it
clear in the source which tests belong to which storage
provider. This change renames the ceph integration tests.
Signed-off-by: travisn <tnielsen@redhat.com>
Since most PRs are focused on a single storage provider,
the tests for other storage providers do not need to be
run. The CI will allow skipping tests for other storage
providers by specifying keywords in the PR description.
Similar to [skip ci], you can now specify [test storage-provider].
For example, [test ceph] will only trigger the test
suites for ceph and none of the other storage providers.
Signed-off-by: travisn <tnielsen@redhat.com>
We do not determine the daemon type and name by string parsing anymore
but passing that info directly in the update call, it's more reliable.
Also removing a bunch of unused functions.
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit makes OnAdd() and OnUpdate() consistent in behavior. They
will do their best detecting if we can upgrade, continue an upgrade or
refuse to do one. It also refuses to downgrade to any version.
It also load ClusterInfo earlier in the controller so that we can
compare the spec version versus the cluster running one.
Signed-off-by: Sébastien Han <seb@redhat.com>
Logs will be lost if we collect them after pods are uninstalled.
So we need to collect them before purging.
Signed-off-by: Sébastien Han <seb@redhat.com>
If we successfully changed all the Ceph version of all the daemon we
consider the upgrade complete and successfully, thus we display a
message.
Signed-off-by: Sébastien Han <seb@redhat.com>
Do not consider clusterInfo Ceph version since it's the one picked by
the spec image.
The CephVersion provided here needs to be the current running version
of Ceph for when it is later passed to OkToStop and checked with
IsAtLeast. If you are upgrading from a pre 14.2.1 version to a
version 14.2.1 or newer, IsAtLeast will incorrectly return true and
then fail trying to run mon ok-to-stop on a mon pod running a pre 14.2.1 version.
Signed-off-by: Sébastien Han <seb@redhat.com>
These were used on a previous patch as a debug, let's remove them. They
are not intended to be displayed.
Signed-off-by: Sébastien Han <seb@redhat.com>
This method does not start anything but creates the deployment. So let's
rename it to createDeployment() instead.
Signed-off-by: Sébastien Han <seb@redhat.com>
rgw wasn't using UpdateDeploymentAndWait() to update its deployment
configuration. We now use it so that it's consistent with the other
daemons configuration.
Signed-off-by: Sébastien Han <seb@redhat.com>
When a cluster is updated with a different image version, this triggers
a serialized restart of all the pods. Prior to this commit, no safety
check were performed and rook was hoping for the best outcome.
Now before doing restarting a daemon we check it can be restarted. Once
it's restarted we also check we can pursue with the rest of the
platform. For instance, with monitors we check that they are in quorum,
for OSD we check that PGs are clean and for MDS we make sure they are
all active.
Fixes: https://github.com/rook/rook/issues/2889
Signed-off-by: Sébastien Han <seb@redhat.com>
The ceph image isn't needed every time the rook image is updated.
Thus, make it optional to copy the ceph image into the cluster.
Pushing the ceph image can be done by uncommenting in the script
when needed.
Signed-off-by: travisn <tnielsen@redhat.com>
In the 0.9 release rook converted the v1beta1 CRD resources
to v1 resources. This conversion code is no longer necessary
as we will be using v1 resources going forward.
The code paths will not be triggered anymore, thus
removing the dead code.
Signed-off-by: travisn <tnielsen@redhat.com>
Add missing docstrings for container image
functions in pod.go, noting the behavior
when getting a container image from a pod
which only has a single container defined.
Signed-off-by: Kristoffer Grönlund <kgronlund@suse.com>
Follow-up to #3436:
The validation module has a defined constant for
label value max length. It makes sense to use it
here.
Signed-off-by: Kristoffer Grönlund <kgronlund@suse.com>
This is not a recommended workflow but useful if people click on "Don’t
see your issue here? Open a regular issue."
Signed-off-by: Sébastien Han <seb@redhat.com>
Blaine Gardner
Travis Nielsen
Sébastien Han
xieyanker
Rohan CJ
Mateusz Gozdek
Dmitry Yusupov
Anton Skriptsov
Alexander Trost
Dinar Valeev
Kristoffer Grönlund