Previous code tried to interpret the string output as a `fmt.Sprintf`
string formatter, mangling `%` into `%!(MISSING)`, etc.
Thanks to go, I don't belive these are exploitable (unlike the similar
error in C).
Since this seemed to be a common error in the codebase, I did a quick
audit by visually inspecting the results of `git grep 'f([^"]'`. I
don't have a good suggestion for automated tests to prevent this in
future :(
Example error (look for `(MISSING)`):
```
E0927 05:31:07.618429 11227 driver-call.go:237] Failed to unmarshal output for command: unmount, output: "2018-09-27 05:31:07.191711 I | exec: Running command: df --type ceph /var/lib/kubelet/pods/95461479-c216-11e8-bcf0-02030782ac80/volumes/ceph.rook.io~rook/oe-scratch\n2018-09-27 05:46:43.808596 I | Filesystem 1K-blocks Used Available Use%!M(MISSING)ounted on\n2018-09-27 05:46:43.808659 I | 10.107.25.147:6790,10.109.173.79:6790,10.104.85.255:6790:/ 151678976 49410048 102268928 33%!/(MISSING)var/lib/kubelet/pods/95461479-c216-11e8-bcf0-02030782ac80/volumes/ceph.rook.io~rook/oe-scratch\n{\"status\":\"Success\"}\n", error: invalid character '-' after top-level value
```
Signed-off-by: Angus Lees <gus@inodes.org>
fix#2193
Fix regression introduced by PR allowing MDS config creation in init
container. This allows the new deployment-based mds clusters to scale
down where currently they can only remain constant or scale up.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
We need this environment variable in the main container, not the init
container, as it's used by the rook ceph-mgr module.
Also fix up the env var counts in the testcase.
Fixes: ca71b7a311 (Ceph mgr: Set up config in init container)
Signed-off-by: Jeff Layton <jlayton@redhat.com>
f26 has been EOL'ed for a while now, so we shouldn't be relying on it.
Update to fedora 28. This necessitates installing libnsl2 for ganesha,
which is not installed in the base image these days.
Long term, we should probably find some way to keep this in sync with
the Fedora release cadence, or rebase onto something more stable like
Centos.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Progress toward issue #2003.
Includes design from design doc PR #1578
Use init containers to create configuration for Ceph mgrs. There is only
one init container in this design. The init container calls the Rook
binary to create Ceph config files which are then shared with the mds
daemon main container.
Once this init is run, the main mds daemon is run. Leaving room to use
the Ceph-versioned image in the future, call `ceph-mds --foreground ...`
to run the Ceph mds.
The refactor to using an init container also necessitated refactoring
the mdses replicaset implementation to a deployment-per-pod
implementation due to a chicken-egg problem. With a single container (in
the before times) the Rook binary was able to call the ceph-mds daemon
with an id generated from the pod name. Since the pod name is not known
before runtime, and the id is one of the few params that must be
specified to Ceph daemons on run, it is necessary to know the id
beforehand; thus the move to a deployment architecture following the
likes of the mon and mgr daemons.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
remove all cosntraints that are not really needed from Gopkg.toml.
we should only be adding constraints that are direct dependencies
of the project and we require a specific version/revision of.
added a vendor.update makefile target that can be used to update
dependencies to the latest.
Signed-off-by: Bassam Tabbara <bassam@upbound.io>
all vendor dependencies in Gopkg.toml now have constraints. this will
ensure that they do not float as people run `make vendor`. if you need
a new package be sure to change the contraint explicitly.
Signed-off-by: Bassam Tabbara <bassam@upbound.io>
this commit updates dep to version 0.5, and adds a check during
CI runs that enforces that the vendor dependencies have not changed.
There is a now a makefile target `make vendor.check` that performs
this check. Also removed the requirement that PR run make vendor as
this will be done by CI.
Signed-off-by: Bassam Tabbara <bassam@upbound.io>
Adds documentation about applying an imagePullSecret to a service
account to allow all pods spawned by the operator to have this
imagePullSecret. This is necessary to access an image
(e.g. ceph-agent) from a private/authenticated docker registry
without changing the current operator code.
Signed-off-by: Daniel Bross <daniel.c.bross@gmail.com>
travisn
Alexander Trost
Fan, Shang Xiang
Angus Lees
Blaine Gardner
Jeff Layton
mickymiek
solidnerd
Huamin Chen
Bassam Tabbara
Jared Watts
Andrea Simonini
Daniel Bross