The ceph-external-cluster-details-exporter.py
generates the json output even with
rgw-endpoint IP from different cluster
Added a check validate_rgw_endpoint which will validate
the above rgw_endpoint Ip by matching the cluster fsid
Signed-off-by: parth-gr <paarora@redhat.com>
OSD on PVC is tested in many patterns but OSD on device is not.
It's preferable to add the following patterns for OSD on device.
- An OSD on a raw disk
- Two OSDs on a device
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Once we are done cleaning up the content of the encrypted osd, let's
close the main LUKS device.
This avoids having dm devices on the system after the cleanup.
Closes: https://github.com/rook/rook/issues/10181
Signed-off-by: Sébastien Han <seb@redhat.com>
Support is removed for k8s for various limitations such as
priority classes not working and csi driver feature
incompleteness and missing snapshots. Documentation is updated
with the new min version of k8s 1.17 and also the tests are
updated to run on the min version of 1.17.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
updating go ceph version to 0.15.0 will no longer require
`ceph_preview` during build. Also if added in VsCode workspace
we can remove that now.
Signed-off-by: subhamkrai <srai@redhat.com>
This new integration test will deploy a cluster with multus enabled. It
will be comprised of two network interfaces for ceph public and cluster
communications.
For now, it only deploys a Ceph cluster up to the OSDs.
Closes: https://github.com/rook/rook/issues/9784
Signed-off-by: Sébastien Han <seb@redhat.com>
The cross build container is not used anymore since the conversion
to github actions. Now the obsolete scripts and makefiles are
cleaned up to remove some confusing leftovers from the
cross container.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The osd destroy command leaves the osd id in use instead
of fully purging the osd id. If the osd id is not also
removed, it gives the impression that there is still
something that needs to be cleaned up from the old osd.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Two test jobs were collecting artifacts to the same artifact name, which
can cause race conditions and failures to upload artifacts.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
PR #9546 missed updating the daily-nightly CI jobs, and logs are no
longer properly collected from the upgrade jobs there.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The upgrade function doesn't seem to be that smart
for now so it can update the new auth caps listed
with the existing one, it only compares the value of
the current cap with the MIN_USER_CAP_PERMISSIONS,
Modified the upgrade flag functionality so we can use
this while upgrading the cluster clients
Closes: https://github.com/rook/rook/issues/9589
Signed-off-by: parth-gr <paarora@redhat.com>
The backend path was added with additional `transit` to it.
Also added PR test case to check transit engine
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The secret is called secrets.IBM_INSTANCE_ID instead of
secrets.IBM_KP_INSTANCE_ID. Now the daily test should pass.
Signed-off-by: Sébastien Han <seb@redhat.com>
For the "if" to work we need to bring the env in the step with the "env"
keyword. Otherwise, the env is never imported and the condition is
always false.
Signed-off-by: Sébastien Han <seb@redhat.com>
For better consistency with IBM_KP_SERVICE_API_KEY and use
"ibmkeyprotect" as a provider name for more clarity.
Signed-off-by: Sébastien Han <seb@redhat.com>
The CSI users created by the external script(both for rbd and cephfs)
need the blocklist capability so the CSI pods can execute the
`osd blocklist` commands for metro DR
update the mon caps of csi users with `profile simple-rados-client-with-blocklist`
so they have privileges to run osd blocklist cmds
Closes: https://issues.redhat.com/browse/RHSTOR-2451
Signed-off-by: parth-gr <paarora@redhat.com>
The cluster-wide encryption feature now has a new supported key
management system: IBM Key protect. More information about the backend
can be found in Rook documentation under the
Today's implementation stores OSD encryption keys has "Standard" keys.
Signed-off-by: Sébastien Han <seb@redhat.com>
The helm tests were previously only for new installs, and did
not have an upgrade path. Now the upgrade path is tested
to give confidence in the helm upgrades.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The local build tag replacement in the CI should work the same
whether in master or release branches, so we use a regex to
match any rook/ceph tag to be renamed to the local-build tag.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
This is handling a tricky scenario where the OSD deployment is manually
removed and the OSD never reconvers. This is unlikely to happen, but
still OSD should be able to run after that action. Essentially after a
manual deletion, we need to run the prepare job again to re-hydrate the
OSD information so that the OSD deployment can be deployed.
On encryption, it is a little bit tricky since ceph-volume list again
the main block won't return anything, so we need to target the encrypted
block to list.
There is another case this PR does not handle, which is the removal of
the OSD deployment and then the node is restarted. This means that the
encrypted container is not opened anymore. However, opening it requires
more work like writing the key on the filesystem (if not coming from the
Kubernete secret, eg,. KMS vault) and then run luksOpen. This is an
extreme corner case probably not worth worrying about for now.
Signed-off-by: Sébastien Han <seb@redhat.com>
Travis Nielsen
Alexander Trost
Sébastien Han
parth-gr
Satoru Takeuchi
subhamkrai
Madhu Rajanna
Yuval Manor
Blaine Gardner
Jiffin Tony Thottan