The cluster-wide encryption feature now
supports KMIP (Key Management Interoperability Protocol)
kms.
KMIP is an extensible communication protocol that defines
message formats for the manipulation of cryptographic keys
on a key management server.
For more information, refer:
https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol
Signed-off-by: Rakshith R <rar@redhat.com>
User can define his desired endpoint list in Zone CR so that it will
overwrite the default service name for rgw.
Resolves#6432
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
Implement the SSSD sidecar design for NFS.
Because NFS documents are getting long, create an NFS
`Storage-Configuration` section with separated topics to keep the `NFS
Overview` document sane.
Adjust the SSSD design to allow any VolumeSource, not just ConfigMaps.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The tool gofmt in go 1.19 requires certain formatting
in the comments section for better rendering.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
During certain maintenance tasks the admin will own running
operations on the ceph mons and osds, and the operator should
not interfere with those operations. If the operator sees
any mon in debug mode, every reconcile and mon health check
will be skipped. Thus, mons will not be updated while any
one of them is in maintenance. During OSD reconcile, individual
OSD deployment updates will only be skipped for OSDs that are
actively being debugged.
The debug mode for osd and mon deployments is signaled by
creating the ceph.rook.io/do-not-reconcile label.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The RGW support server side encryption with help of s3 protocol, till
now the `sse:kms` was support in which keys will be provided by the user
and but it will be saved in external management service like vault. Now
the support for `sse:s3` is added so the entire encryption key
management is performed by RGW itsels.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
this commits add new field `MaxLogSize` inside `LogCollectorSpec` of
cephCluster cr which will take max size of log after which we want to
rotate the log.
Signed-off-by: subhamkrai <srai@redhat.com>
The liveness probe is applied by a more general helper
rather than the specific helpers for each daemon.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
During deletion of a CephBlockPool CR, the underlying ceph
pool was not being deleted. During the deletion sequence
this is due to the spec being refreshed upon a call to
check for dependents in ReportDeletionNotBlockedDueToDependents().
The pool name was then coming up blank during the deletion
request and rook of course then wasn't finding the pool
to delete.
Now Rook properly sets the pool name in the named spec
every time it is converted internally from a CephBlockPool
type to a NamedPoolSpec.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
we should iterate older clusters spec instead of
new cluster spec since in case of new storageClassdeviceset
added in spec. The total count of the new clusters and older
spec cluster is will not be the same and we'll get panic.
Closes: https://github.com/rook/rook/issues/10222
Signed-off-by: subhamkrai <srai@redhat.com>
The endpoint on the rgw realm pull spec is causing a failure
if not specified even when it is not expected to be
required. Now the endpoint has the json property to be
ommitted if not specified.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Currently we are allowing users to change the name
of the pool to be created in the BlockPool CR. with
this we have a bug of leaving stale resources in the
cluster. With new changes we are blocking the update
of the pool name in the BlockPool CR.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
As we are not suppose to update the filesystem name
once the subvolumegroup is created.
added webhook validation for subvolumegroup update.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
As we are not suppose to update the pool name
once the rados namespace is created.
added webhook validation for radosnamespace
update.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Built in Ceph pools (device_health_metrics, .mgr, .nfs) must be
replicated and not erasure coded.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
For supporting features like service account authentication for vault
KMS , a service account account need to attach with pod.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The prometheus rules had been previously created if the cephcluster CR
setting monitoring.enabled was set to true. The rules were not customizable
and therefore not flexible enough. Now the rules are installed by the helm
chart. To customize the rules, a post-processor can be applied to the helm
chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
this commit adding `Phase` in `additionalPrinterColumns` for
all the CRs.
this is how it looks now, example:
```
$ kc get cephfilesystem
NAME ACTIVEMDS AGE PHASE
myfs 1 4m57s Ready
srai@ ~
$ kc get cephblockpool
NAME PHASE
device-health-metrics Ready
replicapool Progressing
srai@ ~
$ kc get cephclient
NAME PHASE
cinder Ready
glance Ready
```
Closes: https://github.com/rook/rook/issues/9883
Signed-off-by: subhamkrai <srai@redhat.com>
In Quincy, the device_health_metrics pool is renamed to .mgr.
In the example cluster-test.yaml, we therefore update the
example to create the pool with the new name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
adding observedGeneration field in the cephcluster cr
status for having better control on reconciling,
as observedGeneration field will be updated by the controller
Closes: https://github.com/rook/rook/issues/9673
Signed-off-by: parth-gr <paarora@redhat.com>
msgr2 allows for encryption and/or compression across the wire.
Settings for enabling the encryption and compression are now
available in the cluster CR to that ceph will be automatically
configured with these settings when desired.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Added unit test for probes changes and
did re-naming of liveness probes file
as it will contain multiple types of probes
Signed-off-by: parth-gr <paarora@redhat.com>
For better consistency with IBM_KP_SERVICE_API_KEY and use
"ibmkeyprotect" as a provider name for more clarity.
Signed-off-by: Sébastien Han <seb@redhat.com>
add annotations to secrets and configmaps to use
different tools to sync secrets and configmap.
Currently, these annotation is applied only on
the `rook-ceph-mon-endpoints` configmap and
the secrets `rook-ceph-mon` and `rook-ceph-admin-keyring`.
Closes: https://github.com/rook/rook/issues/8999
Signed-off-by: subhamkrai <srai@redhat.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
Travis Nielsen
Jiffin Tony Thottan
Rakshith R
zhucan
Blaine Gardner
subhamkrai
Josh Soref
Madhu Rajanna
Yuval Manor
Sébastien Han
parth-gr
Satoru Takeuchi
Yuval Lifshitz