Versions of k8s prior to 1.14 do not support the nullable field in
CRD properties. As k8s 1.13 remains part of our support matrix and
as this field must remain nullable, we must remove CRD validation
of SecurePort. Range validation of this field has been moved into
the logic of rgw.validateStore.
Fixes: #4693
Signed-off-by: Elise Gafford <egafford@redhat.com>
If an image is specified in the external cluster CR, the
'rook-ceph-config' config map will be created and then child CRs like
rgw/mds/nfs can be created.
Also, calling config.GetStore() was a mistake since it's calling by the
health check if new mons are being added to clusterInfo.
Closes: https://github.com/rook/rook/issues/4686
Signed-off-by: Sébastien Han <seb@redhat.com>
Currently each time the ceph operator restart, osds also restart.
This is due to a change in the crush-location args with location not ordered
At each restart the location order can change and lead to that kind of change in the osd deployment
104c105
< "--crush-location=root=default host=hostname datacenter=PAR pod=2 rack=2",
---
> "--crush-location=root=default host=hostname pod=2 rack=2 datacenter=PAR",
Sorting the topology to ensure stability of this command arg
Signed-off-by: n.fraison <n.fraison@criteo.com>
Now, we purely rely on what the user puts in the CR and apply it.
Prior to this commit we were putting 0 if not declared, this was not the
intentional.
Closes: https://github.com/rook/rook/issues/4713
Signed-off-by: Sébastien Han <seb@redhat.com>
We now force the mds daemon to join the fs that was created by Rook.
This can always be changed by using the ceph config store.
Closes: https://github.com/rook/rook/issues/4707
Signed-off-by: Sébastien Han <seb@redhat.com>
If all mons are down (e.g. set the replicas to 0 on all the mon deployments) and the operator is restarted, the operator waits indefinitely for a single mon to start. This PR fixes this issue by skipping the quorum check of mons if the number of ready mon pods is equal to 0.
Signed-off-by: Ashish Ranjan <ashishranjan738@gmail.com>
When the OSDs are being provisioned,
if one cluster has already provisioned the OSDs,
the new cluster will skip them since it will see they are already in use.
So we don't need this check anymore.
Coordinating the flag across multiple cluster instances is more complicated than it's worth.
Someone also might want useAllDevices: true in multiple clusters
and they would keep them on separate nodes by using the node labels and selectors.
Closes: https://github.com/rook/rook/issues/4633
Signed-off-by: Sébastien Han <seb@redhat.com>
A new CR setting has been introduced to disable the crash controller.
To disable it, add `disable: true` on the crashCollector section.
Signed-off-by: Sébastien Han <seb@redhat.com>
We now use a defined directory for each prepare job so that logs won't
be entangled with each other.
Also, if an error occurs, we print the log file too so we don't have to
ssh onto a host to find the c-v debug log.
Closes: https://github.com/rook/rook/issues/3888
Signed-off-by: Sébastien Han <seb@redhat.com>
We now support partitions via 2 ways:
* if `useAllDevice: true`: partitions will be taken into account and
presented as OSD candidate
* if specified in the cluster CR: it'll picked up as well
Signed-off-by: Sébastien Han <seb@redhat.com>
Added a check for --crush-location, if --crush-location is not present,
the node topology is not applied and the operator will need to determine
the value based on the node labels instead of skipping this setting.
Signed-off-by: rohan47 <rohgupta@redhat.com>
The host name of an OSD in the CRUSH map should be the real
host name for non-portable OSDs. It was incorrectly being set
to the PVC name. Now the non-portable OSDs based on PVCs will
corretly have the host name set to the node name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The method to construct osd environment variables is simplified
by passing a struct param instead of individual params
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The minio operator has not had community support nor
any updates since being added to Rook. Support is being
removed from Rook due to this lack of community interest.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The retry messages are too verbose with the stack trace
since the aggregated messages were added. This change
turns off the verbose message.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
A new CRD option `continueUpgradeAfterChecksEvenIfNotHealthy` is added.
When upgrading, Rook goes OSD by OSD and then waits for PGs to be clean
before proceeding to the next OSD. Currently, Rook waits for 5 hours but
there might be circumstances where PGs need more time to settle.
Thus setting `continueUpgradeAfterChecksEvenIfNotHealthy` to true will
pursue the upgrade process, even if PGs are not 100% active+clean.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1786029
Signed-off-by: Sébastien Han <seb@redhat.com>
Add support for the k8s 1.17 official zone/region failure domain labels.
Our earlier guess that the official labels would be
<failure-domain.kubernetes.io> was wrong; the official is now
<topology.kubernetes.io>.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
The operator kit had more utility originally when the operator
was creating and managing the TPRs and CRDs directly. Since
the CRDs are now created from a manifest and no longer by the
operators, the utility of operator kit is limited to the
controller watcher. Since we are moving to the controller runtime
we simplify the code to make the transition smoother. Now
there is only a simple WatchCR method that will need to be
replaced as we maek that transition.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Replaced `math/rand` with more secure `crypto/rand` which will generate CSPRNG.
Changed the length of dashboard password from 10 to 20 and included more special characters that can strengthen password.
Passwords before this change: QoMmqLkaOf,8tqTyWF1sZ
Passwords after this change: L{QZ@_c'Rl7$uvW:UHU1, fP-OjX`UVw0J0Ka/scS(
Resolves: https://github.com/rook/rook/issues/4571
Signed-off-by: Nizamudeen <nia@redhat.com>
Fix security issues identified by TrailOfBits:
Logging of sensitive information in debug mode
Problematic debug lines which can contain sensitive data have been removed
Resolves: #4568
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
If obj is not successfully cast into an e dgefsv1.Cluster, ok will be false, resulting in the .Update(cluster) operation not running, and the declared err variable retaining its default nil value. Subsequently, a check against err is performed, which will evaluate to false, resulting in logging the finalizer as removed when it in fact was not.
Signed-off-by: Nizamudeen <nia@redhat.com>
Elise Gafford
Sébastien Han
Dustin Guerrero
Elias Wimmer
n.fraison
Travis Nielsen
Ashish Ranjan
rohan47
Arnav Agarwal
Dmitry Yusupov
Blaine Gardner
Nizamudeen
Juan Miguel Olmo Martínez