This change adds support for skipping reconciliation of CephNFS daemons
that are labeled with `ceph.rook.io/skip-reconcile=true`.
Similar to MDS, MGR, and RGW components, this allows cluster operators
to prevent Rook from modifying specific NFS daemon deployments.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 612e54e1ae)
when a reconcile returns a requeue result without an error
(e.g. due to a missing cephcluster), the previous logic reported
it as a successful reconcile. this was misleading and made it
hard to understand the actual controller behavior this
change adds a new condition to log and emit a "requeuing" event
when reconcileResponse.Requeue is true and err is nil.
this ensures more accurate event reporting and improves observability across
all controllers using reportreconcileresult.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 83ce9a6a63)
This PR sets CSI_ENABLE_METADATA to true by default in the
Rook configuration, ensuring that the --setmetadata=true
flag is added to CSI nodeplugin pods
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit ce59c72eb1)
The Kubernetes CSI sidecars have had several releases that were not
included in deployments by Rook yet, update them to the versions that
are available today:
- csi-attacher:v4.8.1
- csi-provisioner:v5.2.0
- csi-resizer:v1.13.2
- csi-snapshotter:v8.2.1
This change is important, because Ceph-CSI will implement the new
Controller.GetSnapshot CSI procedure. A bug in csi-lib-utils causes a
panic when a ControllerCapability is provided, but not (yet) known to
the CSI sidecars. The updated sidecars consume a version of
csi-lib-utils with a fix for that panic.
See-also: kubernetes-csi/csi-lib-utils#188
Signed-off-by: Niels de Vos <ndevos@ibm.com>
(cherry picked from commit a168c40008)
When monitoring is enabled, if the service monitor fails
creation, the reconcile will fail and rook will never
create the OSDs. A number of users have been blocked during
install due to this issue. Let's allow reconcile of the
full cluster even in this error case. After they install
prometheus, they would then need to trigger a reconcile again
perhaps by restarting the rook operator to enable
the service monitor.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit ca12916438)
With a osd resize operation, currently pvc and pv may
takes more time then expected.
And so the osd dont get resized and need manual re-start
as currently we don't have a watch on osd's
controller that watches pv and get it resized.
add a wait time till pvc is not resized
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 94450c0db7)
When multiple `CephObjectStoreUser` CRs are present, the operator logs a
high volume of `CephObjectStore "foo" found` messages during reconcile.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit f1fad531eb)
When a rados namespace is deleted, it cannot be purged
until its images and snapshots are deleted. Now a condition
is being added to the rados namespace CR status so the user
does not need to read the operator log to discover the cause.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 530223c5b4)
When the blockpool is deleted and there are images or
snapshots in the pool, the deletion is blocked by the
finalizer until they are all removed. The condition added
to the cephblockpool status only indicated if there were
radosnamespace dependencies. A new condition is now added
to describe if there are images or snapshots.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 0a3a599580)
ceph-csi uses an exclusive lock for cryptfs operations. This needs the x capability on the metadata pool.
Fixes#15283
Signed-off-by: Felix Prasse <1330854+flx5@users.noreply.github.com>
(cherry picked from commit 8f53522162)
Named containerPort is a useful feature when generating dynamic scrape
targets with prometheus.
This makes it clear that the containerPort is intended for metrics
scraping.
The name matches that which is on the mgr deployment.
Signed-off-by: Justin Cichra <jcichra@cloudflare.com>
(cherry picked from commit 12c36e9472)
improving logging to include name and namespace of resource
and also namespace should not end with period.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit fe776fd4fe)
Adds .spec.cephConfigFromSecret to CephCluster for loading
Ceph config parameters from a Kubernetes Secret.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 45b0ef2104)
Lower the verbosity of a message in the notification controller's OBC
label watcher. If the OBC controller is having issues provisioning the
OBC, this log will spam every 10 seconds. Reduce the message verbosity
level to debug.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 08233d5b6d)
The object store controller was swallowing errors of the
type not found, assuming a certain category of errors
when ceph may still be initializing. But some of these
errors could be user error and they need to troubleshoot
the details of the error, so we need to log the specific
error instead of swallowing it.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 95a5920bef)
userSecretRef and passwordSecretRef fields are added to allow the Kafka
endpoint username and password to be supplied from a Kubernetes Secret,
rather than exposed as plaintext as part of the endpoint URI. If the
endpoint URI has HTTP basic auth user-id and user-pass components, they
are overridden by userSecretRef and passwordSecretRef.
Squid added bucket topic attributes for configuring the user-name and
password for pushing notifications to Kafka as an alternative to
encoding credentials into the URI. However, these attributes are not
supported under Reef. Thus, this initial implementation relies on URI
mangling for compatible with both Reef and Squid. Future work could
using Ceph version detection and switch to the new attributes to be used
with Squid and/or the implementation could be converted exclusively to
use the new attributes once Rook has dropped support for Reef.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 7887f03c5c)
In case of multicluster service, we need to always delete the mon-canary
pods even if there is any failure while exporting the service, else
multiple mon canary pods will get created.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 75c6bb8cd2)
In some cases, for example, kube-api nods, CephBlockPool's status
could be failed to update. In that case, rook-operator does not
tries to update status again. This fix requests for requeue if pool's
status update is failed.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
(cherry picked from commit d7c67fecee)
When finalizers are added to the CRs, a follow-up reconcile
will be triggered due to the increased generation on the CR.
Therefore, abort the initial reconcile when adding the finalizer,
and allow the follow-up reconcile to complete the configuration.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit f7fb1bc0f2)
the maxunavailable count was getting reset back to 1 after 60 seconds.
This PR prevents resetting of the maxUnavailable OSD count.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit e83ca35531)
EnableCSIDriverSeLinuxMount is always set to true
, This commit remove the extra variable as its a
introduced where we supported older kubernetes version.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit b08765f525)
NFS-Ganesha 6.1 requires this config to be set to allow it to run in a
non-privileged container so it doesn't hit a permission failure. As long
as the ganesha.nfsd process isn't run with the `-x` option, earlier
versions of NFS-Ganesha that don't have this config won't complain.
Related cephadm PR: https://github.com/ceph/ceph/pull/60077
This may be necessary for supporting future Ceph Squid versions
according to discussions here:
https://github.com/ceph/ceph-container/issues/2246
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 947ca8b458)
Also check for the empty namespace instead of an
empty name which was incorrect.
Co-authored-by: Nikita Sivukhin <sivukhin@turso.tech>
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 71a4fce87b)
All existing controller runtime watches are converted to use "typed"
handlers and predicates instead of operating on `client.Object`. The
intent is to be bug for bug equivalent with the existing logic while
replacing run time type assertions and switch statements with compile
time type constraints and type casts. In several cases, functions using
assertions were split up such that each function only handles a single
Kind at a time. It is hoped that this will improve readability and
maintainability while facilitating future refactoring such as migrating
some watches to using IndexFields.
Of particular note is that the massive switch statement in
`WatchControllerPredicate()` from
`pkg/operator/ceph/controller/predicate.go` has been replaced with
generics, reflection, and splitting the obc logic into its own predicate
function. There are still many helper functions operating on
`client.Object`. These were not updated unless required by the compiler
in order to limit the size of this change. The type safety of these
funcs should be improved as followup work.
It is strongly suggested that going forward, handlers and predicates
only handle a single Kind (generic or not) and that switches / type
assertions are heavily discouraged or forbidden. This PR removed all
but a single switch statement in a predicate, which should be addressed
in future work.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 9f1ed201db)
Fixes an ordering issue where spec.cephConfig settings failed to apply
because the manager wasn't yet running. Moved the config logic from
postMonStartupActions() to a new postMgrStartupActions() to ensure
the mgr is ready before applying config, allowing successful reconciliation.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 44a2eaf02f)
this commit add support for mirroring b/w implicit rados namespace and
defined rados namespace. To support this, rook will treat `<implicit>`
name on cephblockpool as `""` empty string. This will allow mirroring
b/w implicit and defined radosnamespace.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 420178fe3e)
The unit test TestWaitForDeploymentsToUpdate intermittently failed
in the CI. The suspected root cause is clow CPUs in github CI runners.
This fixes the intermittent CI failure by increasing the timings in the test
code.
Resolves: #15583
Co-Authored-By: Blaine Gardner <blaine.gardner@ibm.com>
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 0c9e7a384b)
The change creates and manages an Endpoints resource
with the current Ceph monitor (mon) IPs, allowing
clients to resolve mon IPs via DNS without relying
on the rook-ceph-mon-endpoints ConfigMap.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 08199b27c9)
allows selecting Read Affinity policy from the ObjectStore API
aets `--crush-location=host` for RGW daemons.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit deb010c32e)
One ore more OSDs can be down and PGs can still be active+clean (data
was rebalanced to other available OSDs). This PR sets
maxunavailable=1+downOSDs to allow one healthy to be drained.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
topic.reconcile() had a number of error triggered return statements
which did not update the CR's status to reflect a reconcile failure.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Patryk Rostkowski
Oded Viner
Travis Nielsen
Niels de Vos
Carlos Barria
parth-gr
Joshua Hoblitt
Artem Torubarov
Felix Prasse
Justin Cichra
subhamkrai
Blaine Gardner
Santosh Pillai
Rakshith R
Peter Razumovsky
mergify[bot]
Madhu Rajanna
Ragnar Dahlén
Michael Adam