Previously, if the OSD cephx-keyring-update init container couldn't
contact the mons, the output redirect would overwrite the on-disk
keyring file with no text, removing the on-disk keyring.
Modify the init container to only overwrite the keyring file when the
ceph command to get the latest key suceeds, to avoid removing the
on-disk key.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
`updateExistingOSDs` should not wait and retry if the golang context got
cancelled. Else it would keep on retrying for 20 minutes before
exciting.
Signed-off-by: Santosh <sapillai@redhat.com>
When CSI_ENABLE_HOST_NETWORK is set run the
csi controller plugin pods on the host network
closes: #16960
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Update the CA bundle volume mount permissions to read-all (o444). RGW
runs as 'ceph', but the volume mount defaults to 'root'. o444 ensures
the RGW can read the bundle.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
since node fencing is disabled in rook for sometime
and this feature is implemented in csi. So, this
commits remove obsolete code related to node loss
Signed-off-by: subhamkrai <srai@redhat.com>
The do-not-reconcile label on the mon deployments was
causing the mon reconcile to be skipped for all mons,
even if the label was only on a single mon. Now, the
skipping of reconcile will only be scoped to a single
mon.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add ceph version check to determine CA bundle configuration method.
Ceph Tentacle+ supports CURL_CA_BUNDLE environment variable, while older
versions require system CA trust update via init container.
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
This mounts custom CA bundle directly to the RGW container at
/etc/ceph/rgw-ca-bundle/ and CURL_CA_BUNDLE points to the certificate
file. Ceph changes regarding CURL_CA_BUNDLE variable is in this PR:
https://github.com/ceph/ceph/pull/44283
This change simplifies the CA bundle handling by:
- Removing the update-ca-trust init container and related volumes
- Mounting the CA bundle secret directly to the RGW pod
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
Read affinity in Ceph v20.2.0 can cause corruption.
Disable this feature for this version of Ceph to
avoid hitting any corruption in this case. When the next
patch release is out for tentacle, this issue will be
resolved and when upgrading to it, read affinity would
automatically be re-enabled if needed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
if admin secret is created stop creating csi secret from
the rook operator
the csi creds and secret will still be created by the python and
the import script
Signed-off-by: parth-gr <partharora1010@gmail.com>
add support for ceph.rook.io/do-not-reconcile on cephcluster crs
skip reconcile early and emit a normal reconcile-skipped event
avoid reloadmanager on updates for labeled cephclusters
add unit test for skip behavior
Signed-off-by: Oded Viner <oviner@redhat.com>
The udev is required for cleanup in both host-based clusters
and pvc-based clusters since the tentacle release.
The cleanup jobs were failing in pvc-based clusters
with tentacle where we skipped adding the udev mount.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
previously, if multiple mount option was passed it was
handing it wrong. For example,
```
ms_mode=prefer-secure,recover_session=clean
```
was treated as
```
ms_mode: prefer-secure,recover_sessio
```
With current fix it handles it correctly. Example,
```
ms_mode: prefer-secure,
recover_session=clean,
```
Signed-off-by: subhamkrai <srai@redhat.com>
in endpoint slice for the mgr and rgw service
it was harcoded to use the ipv4,
now dynamically assign the type based on the endpoint
ip adrress type
Signed-off-by: parth-gr <partharora1010@gmail.com>
For all of the controllers besides the cluster controller,
the logging now includes the namespaced name of the resource
that is being reconciled. This will help with log troubleshooting
to help analyze logs consistently for the resource being
reconciled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
Add a resource watch to reconcile clusters when any referenced Secrets
in cephConfigFromSecret are updated. This matches the behaviour of
reconciling clusters when cephConfig changes. Without this change, if a
Secret that is referenced by cephConfigFromSecret is updated, then the
cluster is not immediately updated, so the cluster state will not match
the configuration until something else triggers a reconcile.
Resolves#16371
Signed-off-by: Martin Rowe <martin.p.rowe@gmail.com>
The logger names are seen on each line of logging. As
long as they are unique, they really don't need to be
long and descriptive, so let's make them a bit more
concise, and independent from controller names.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When writing to the operator log, where possible
the namespace of the resource on which the operator
is working will be logged as a standard prefix
to more easily troubleshoot what resource is being reconciled
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The activeStandby property was being ignored when deciding
how many mds daemons to start. 2x the active count of mds
daemons were always being created. If the standby is not
desired, the standby can be removed, and it was unexpected
that it was not removed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Use a sync map for the clusterMap in the cluster controller
and fix other issues to allow for concurrent cluster
reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cephcluster controller allows setting concurrent reconciles
with a setting in the operator configmap.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
currently, in SVG crd while updating status we don't have retryOnConflicts
similar to other CRD, this commit add the retryOnConflicts.
Signed-off-by: subhamkrai <srai@redhat.com>
In a running cluster, I noticed that a node which was provisioning was removed from k8s
and the following log was emitted by the rook operator:
```
op-osd: cleaning up dangling OSD prepare status configmap "rook-ceph-osd-xxx-status"
```
But the osd provisioning job was still trying to run on the removed node:
```
rook-ceph-osd-prepare-xxx Running 0/1 4d22h 4d22h
```
This PR implements a mechanism to remove any osd provision jobs which are bound to a
node which no longer exists within kubernetes. I added a test for this cleanup as
there wasn't a pre-existing test.
Signed-off-by: Elias Carter <elias@dropbox.com>
Blaine Gardner
subham rai
Santosh
Madhu Rajanna
Joshua Hoblitt
subhamkrai
Travis Nielsen
Oded Viner
Praveen M
Sunnatillo
Parth Arora
dependabot[bot]
Jongwoo Han
Martin Rowe
Steve Wills
Elias Carter