Enabling crush updates is false by default, and can be enabled
if set to true. The setting needs to be nullable in case
we need to differentiate between the value being set
to false or just not set, to know if the default should be
different. This is necessary for rook consumers who are
refererencing the pool struct and want to change the default,
rather than using rook's default value of false.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit df49ca1247)
Resolves this incorrect field description:
~ $ k explain cephobjectzone.spec.zoneGroup
GROUP: ceph.rook.io
KIND: CephObjectZone
VERSION: v1
FIELD: zoneGroup <string>
DESCRIPTION:
The display name for the ceph users
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8b58d68592)
Resolves this incorrect field description:
~ $ k explain cephobjectzonegroup.spec.realm
GROUP: ceph.rook.io
KIND: CephObjectZoneGroup
VERSION: v1
FIELD: realm <string>
DESCRIPTION:
The display name for the ceph users
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 1a1478a342)
The securityContextConstraints require setting whether
host networking and host port access is needed by the
ceph cluster service accounts. The helm chart now allows
enabling this mode with the settings:
rook-ceph chart: useOperatorHostNetwork: true
rook-ceph-cluster chart: cephClusterSpec.network.provider: host
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 82262a8472)
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit 182cd211ca)
This enables configuring the CrossNamespaceVolumeDataSource feature gate
Signed-off-by: CL0Pinette <me@cl0pinette.fr>
(cherry picked from commit b63c222d17)
The `CephBlockPool` CR allowed any algorithm to be specified in
`spec.erasureCoded.algorithm`, but in practice only `isa` or `jerasure`
would work.
Make that restriction explicit by restricting this field to `isa` or
`jerasure` in the CRD.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit 0b423a30f9)
With the new squid patch release, update the base
image, the docs, and the examples to all use the latest
stable Ceph release v19.2.3.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 66a006b99c)
# Conflicts:
# tests/manifests/test-cluster-on-pvc-encrypted.yaml
The rook-ceph SecurityContextConstraints in the rook-ceph helm chart does not include all the users necessary for a successful deployment. Specifically, rook-ceph-default, rook-ceph-mgr, rook-ceph-osd, and rook-ceph-rgw are listed in the operator-openshift.yaml example file (https://github.com/rook/rook/blob/master/deploy/examples/operator-openshift.yaml) but are not included in the helm chart. This commit adds these users.
Signed-off-by: Mason Buchanan <masonwb@gmail.com>
(cherry picked from commit a030d2ceb3)
Fixes quick disk shredding by using dd to shred data at additional offsets where ceph metadata is duplicated. For full shred, the shred utility remains in use.
Signed-off-by: Vilius Puškunalis <47086537+puskunalis@users.noreply.github.com>
(cherry picked from commit 27010f96f3)
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 7f3e6bd7fa)
Added a flag in cephcluster CR CSI section
whether the user wants the Rook to manage
the csi users and secrets or create them on own.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 5094b1f5e6)
When cephClient CR is created by User, the Rook
is creating an User and creating an secret with
its own predefined name + CR name, With this we
are allowing user to specify the secretName
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit d6d2e604fc)
allow targetSizeRatio == 0
enforce targetSizeRatio >= 0 via +kubebuilder:validation
set targetSizeRatio and compressionMode="" if unset
remove IsTargetRatioEnabled() and IsCompressionEnabled()
Signed-off-by: Oded Viner <oviner@redhat.com>
(cherry picked from commit dd65dc15d8)
This change returns the use of nested if clauses
instead of `and` function shortcut to avoid errors
in older helm versions.
Signed-off-by: Artyom Babiy <artyom.babiy@gmail.com>
(cherry picked from commit 1f183bd675)
This change allows the chart consumer to optionally
edit PrometheusRule CR by either disabling individual
alerts or tweaking their configuration.
Signed-off-by: Artyom Babiy <artyom.babiy@gmail.com>
(cherry picked from commit 6468255191)
Allow force creation of OSD on a device previously configured in a different ceph cluster.
The OSD prepare pod job will zap the OSD disk using ceph-volume lvm zap
if that disk has metadata from a different ceph cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
(cherry picked from commit 2bcf196b15)
Allow to assign custom labels for toolbox deployment. Some audit policies require specific labels for all kubernetes objects.
Signed-off-by: Juri Malinovski <juri.malinovski@coolbet.com>
(cherry picked from commit cc7e6b328b)
nfs short name and crd name was same
which was conflicting,
remove the short name cephnfs as it can
be already called by the crd name
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 9a0490982e)
This change allows to use wildcard for object ingress configuration.
Allows to use virtual-host style bucket URLs with ingress.
Signed-off-by: synthe102 <leonard@suslian.engineer>
(cherry picked from commit 81d27753f2)
This commit Assigns short names to all Rook CRDs
to improve kubectl usability.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit ae6e1e0863)
The Kubernetes CSI sidecars have had several releases that were not
included in deployments by Rook yet, update them to the versions that
are available today:
- csi-attacher:v4.8.1
- csi-provisioner:v5.2.0
- csi-resizer:v1.13.2
- csi-snapshotter:v8.2.1
This change is important, because Ceph-CSI will implement the new
Controller.GetSnapshot CSI procedure. A bug in csi-lib-utils causes a
panic when a ControllerCapability is provided, but not (yet) known to
the CSI sidecars. The updated sidecars consume a version of
csi-lib-utils with a fix for that panic.
See-also: kubernetes-csi/csi-lib-utils#188
Signed-off-by: Niels de Vos <ndevos@ibm.com>
(cherry picked from commit a168c40008)
there is a change from ceph on how the status
of the mirroring will look like,
Adopting with new fields so the status is correctly synced,
And other components might rely on the status too
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit aa326a9419)
Provider validation is failing on updating from empty string to non-empty ones
which is expected to be supported. Fix the validation rule by adding one missing
condition.
Signed-off-by: Yifeng Zhang <Yifeng.Zhang@cerebras.net>
(cherry picked from commit 93ccf4c9c2)
When a rados namespace is deleted, it cannot be purged
until its images and snapshots are deleted. Now a condition
is being added to the rados namespace CR status so the user
does not need to read the operator log to discover the cause.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 530223c5b4)
Adds .spec.cephConfigFromSecret to CephCluster for loading
Ceph config parameters from a Kubernetes Secret.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
(cherry picked from commit 45b0ef2104)
The v1.17.0 release missed setting the proper helm
tag for the version to deploy of the operator.
Updating to ensure the next release will include the
correct version.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
userSecretRef and passwordSecretRef fields are added to allow the Kafka
endpoint username and password to be supplied from a Kubernetes Secret,
rather than exposed as plaintext as part of the endpoint URI. If the
endpoint URI has HTTP basic auth user-id and user-pass components, they
are overridden by userSecretRef and passwordSecretRef.
Squid added bucket topic attributes for configuring the user-name and
password for pushing notifications to Kafka as an alternative to
encoding credentials into the URI. However, these attributes are not
supported under Reef. Thus, this initial implementation relies on URI
mangling for compatible with both Reef and Squid. Future work could
using Ceph version detection and switch to the new attributes to be used
with Squid and/or the implementation could be converted exclusively to
use the new attributes once Rook has dropped support for Reef.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 7887f03c5c)
Update the examples and docs and operator base image to
the latest ceph release v19.2.2.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit f62e6d9cc2)
Travis Nielsen
Michael Adam
Joshua Hoblitt
Oded Viner
CL0Pinette
Benoît Knecht
Steve Wills
Madhu Rajanna
Mason
synthe102
Vilius Puškunalis
Patryk Rostkowski
Muhammad Adil Ghaffar
Artyom Babiy
Santosh Pillai
Juri Malinovski
parth-gr
Niels de Vos
Yifeng Zhang
Bryan Jones
Rakshith R