User can define his desired endpoint list in Zone CR so that it will
overwrite the default service name for rgw.
Resolves#6432
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
For the Rook v1.10 release we want the latest version of Quincy to
be the default deployment. Updating to v17.2.3 with the latest
patch release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Implement the SSSD sidecar design for NFS.
Because NFS documents are getting long, create an NFS
`Storage-Configuration` section with separated topics to keep the `NFS
Overview` document sane.
Adjust the SSSD design to allow any VolumeSource, not just ConfigMaps.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The cluster CR doc is extremely long and in need of refactoring.
Now we have four new sub-topics for a host-based cluster,
PVC-based cluster, stretch cluster, and an external cluster.
Each of those topics has its own description and examples.
The main cluster CR topic still contains the details about
all the possible cluster CR settings.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This is the latest version of the design to mitigate the bug encountered
when restarting the `csi-plugin` pod.
Signed-off-by: Sébastien Han <seb@redhat.com>
Update upgrade and supporting docs for release of Rook v1.9.
Include pending release notes as part of this update.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The colon character is not allowed in secret names, therfore the secret
with the subuser credentials must use another character to join the
user and the subuser name.
This in turn makes the mapping non-injective (which has security
implications).
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Make explicity how the operator acts when the subuser list in the
CephObjectStoreUser CR is changed.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Since only OpenStack Identity API version 3 is supported the
API version need not be configurable in the resource.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
As proposed in the review the natural target version for this feature is
1.9 which is to be released around March 2022.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The open questions have been resolved in the discussion and the chosen
solution has been added to the main text. So the Open Questions section
is obsolete now.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The goals/non-goals were mixed up to a degree. This
cleanly separates them to their respective sections.
In the course of that the term "Keystone API" was replaced by the more
correct "OpenStack Identity API" and the documentation of the API was
linked.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Instead of mixing configuration for different protocols in the gateway
section, depending on the type option, introduce a new section protocols for
API specific configuration.
This allows configuring s3 and swift in one RGW and at the same time
simplifies validation of the CRD and allows for a clean separation of
concerns.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
* add annotations to the examples of new CR fields
* add links to external documentation
* clarify language issues raised in review
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The prior formulation which openrc variables take effect was
ambiguous/contradictory.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Access to the Swift API is granted via subusers. The configuration
of the subusers is added to the cephobjectstoreuser CR.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The integration of Keystone includes HTTPS API calls to Keystone. We
document why the CA bundle used to verify those connections,
can't be explicitly configured and how it can be indirectly configured.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
It is not clear at this moment whether anyone has a use case for this.
As a workaround you can explicitly generate a user and subuser that
can access the bucket created via OBC.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Ceph RGW supports integrating with OpenStack clouds by providing
the Swift object store API and using Keystone for authentication.
The design document describes how the required configuration shall
be mapped to the Object Store CRD.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
If the admin wants to use insecure TLS to validate connections to rgw
internally, the TLS secret can have another entry "insecureSkipVerify"
and set it to "true".
Signed-off-by: Sébastien Han <seb@redhat.com>
replaces all occurences of lduo/rduo quotation marks to make
sure that using the snippets in a k8s manifest will work
This fixes an issue with ArgoCD not being able
to apply `common.yaml` because of an encoding issue
Signed-off-by: PixelJonas <jonas@janz.digital>
The flex driver has been fully deprecated and thus removed from Rook.
Before upgrading to v1.8, users will need to convert existing flex volumes
from flex to csi volumes.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Jiffin Tony Thottan
Blaine Gardner
Travis Nielsen
Josh Soref
Sheetal Pamecha
Jiffin Tony Thottan
parth-gr
subhamkrai
Alexander Trost
Sébastien Han
Sebastian Riese
Yuval Lifshitz
PixelJonas