run the tools pod with the rook-ceph-default service account
setting the service account for the pod prevents SCC violations on openshift
Signed-off-by: amrut-asm <amrutrn1@gmail.com>
Add test to canary-integration-test scenarios which removes
osd auth and then recovers it on osd activation from keyring
file.
Resolves: #14825
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
If host path keyring file exists and created during osd-prepare but not
imported to ceph auth then rook-ceph-osd activate init container will
create new keyring in ceph auth by ceph auth get-or-create command. To
avoid keyrings difference in host path and in ceph auth, consider
importing key from host path keyring file if no keyring found in ceph
auth.
Resolves: #14825
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
openshift cluster need to have access to
finalizers when we set the blockOwnerDeletion
if an ownerReference refers to a resource
we can't set finalizers on, This adds the extra
required permission
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Previously arbiter monitors were allowed to failover in supported versions
of Ceph. This behaviour regressed. Since all supported versions of Ceph now
support this, we no longer need to check this at all.
Signed-off-by: Grant Fleming <gfleming@evroc.com>
enable and disable the status of rados namespace
mirroring by looking at statusCheck spec of blockpool
Signed-off-by: parth-gr <partharora1010@gmail.com>
csiaddons required new RBAC in the next
release to create/update the csiaddonsnode
object based on the owner deployment/daemonset
names of the pods its running with.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
currently if we disable the monitoring for cephblockpool
it didnt worked, as there was no check to cancel it
if the mirroring is still enabled
Add a check to disable the monitoring if mirroring is still enabled
closes: https://github.com/rook/rook/issues/14958
Signed-off-by: parth-gr <partharora1010@gmail.com>
This PR fixes an issue where disabling enableRBDStats in CephBlockPool did not remove
the pool from rbd_stats_pools, leading to unnecessary monitoring.
The update ensures that when enableRBDStats is set to false,
the pool is properly removed from rbd_stats_pools, optimizing resource tracking.
Signed-off-by: Oded Viner <oviner@redhat.com>
Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.
5.2.8 Minimize the admission of containers with added capabilities
Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
The devel images have been fairly stable for Rook to test
against, but on occasion there are regressions from
Ceph development that affect the Rook CI. For stability during
Rook development, use the latest stable version of ceph for
PRs, master, and release tests. The daily CI will still use
the devel images from Ceph.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The upgrade of the mds daemons pauses to wait for the
stopping of standby daemons before the filesystem upgrade
is completed. If there are multiple filesystems, there
could be standbys for other filesystems that will not be
stopped at the time of the upgrade of another filesystem.
Thus, the standbys may not upgrade and be stuck on the
previous version. Now, the standby upgrade will only wait
for standbys for the same filesystem.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
If there are multiple clusters, `dataDirHostPath` must be unique
for each cluster. However, it's not documented yet.
In addition, `ceph-teardown.md` was also updated because
the original document assumes that `dataDirHostPath` is
`/var/lib/rook` and the files for a cluster `rook-ceph` is
under `/var/lib/rook/rook-ceph`.
related issue:
https://github.com/rook/rook/issues/14790
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
If the cmd-reporter key is set under the resources
element in the CephCluster CR, the memory and cpu request
and limits will be set on the ceph detect version job
and network job accordingly.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For nodes that are explicitly requested for deploying
OSDs, they will be skipped temporarily if not
schedulable or not ready. A future reconcile is
expected to schedule them. Allow the OSDs to be
scheduled even on these nodes that are temporarily
down, even if it blocks the reconcile from completing.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In Rook v1.6 some new properties were added for
ceph object store users, so the CI was skipping
validation of that setting in the upgrade test.
Now we are far past the need for that flag, and we
can assume the latest flags exist for the tests.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The version checks for the csi driver are removed now
since they are all obsolete. The K8s version and cephcsi
versions are no longer checked. Anyway, the move to the
csi operator would take ownership of version checks
needed in the future, so for now we simplify rook
deployment of the csi driver.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
dependabot[bot]
amrut-asm
Travis Nielsen
parth-gr
Peter Razumovsky
subham rai
Madhu Rajanna
Grant Fleming
Santosh Pillai
parth-gr
Blaine Gardner
Oded Viner
Artem Torubarov
Satoru Takeuchi