Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
Hybrid pools suffer from lower availability when a node goes down,
so we recommend primary affinity instead of hybrid pools.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
An older version of the Helm chart always installed RBAC permissions for
enabling monitoring. In an effort to reduce the privileges Rook uses by
default, they were removed. We need to still include the monitoring RBAC
optionally since the change could break some users.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Co-authored-by: Blaine Gardner <blaine.gardner@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
In 1.8, the admission controller has merged with the operator and the
operator needs an emptyDir and a volume mount to store the webhook
certificates.
Co-authored-by: Blaine Gardner <blaine.gardner@redhat.com>
Co-authored-by: Sébastien Han <seb@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Remove the poolConfig in CephNFS to prevent different CephNFS CRs from
contending to change the replication spec of the default NFS pool.
Resolves#9355
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
NFS docs need to be updated to reflect changes between Octopus and
Pacific, how users are affected, how NFS is configured differently
between the Ceph versions, and how to upgrade from one Ceph version to
the other.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The failure domain is baked into the crush rule that is
created for a pool. To allow for an updated failure domain
on the pool, create a new crush rule specific for that
failure domain and update the pool with the new rule.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Since the cluster helm chart was created in v1.7, the new helm
chart specifies the ceph image, so we clarify the upgrade
doc with the latest info.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When creating EC fs, create replicated pool as primary
pool and ec pool as secondary pool, creating ec pool
as primary is not encouraged and it will lead to failure.
Also, changing the pool name in storageclass-ec file.
Closes: https://github.com/rook/rook/issues/8210
Signed-off-by: subhamkrai <srai@redhat.com>
It should be possible to configure the storage classs mount options, this follows
the helm code used by the ceph-csi project for their ceph-csi-rbd and ceph-csi-cephfs
helm charts.
Signed-off-by: Tom Hellier <me@tomhellier.com>
This commit introduces a new configuration option for
ceph csi driver to enable hostpath mounting of /etc/selinux
directory from the cluster node where csi plugin pods are
running, which inturn help the csi driver to specify
selinux-related mount options like context.
Ref# https://github.com/ceph/ceph-csi/issues/2295
The default value for this configuration is true and if cluster
nodes are running without selinux enabled, an admin can deploy
csi pods by specifying this option to `false` which skip the
host path mounting for the csi pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
The instructions to deploy a developer environment are useful and should
be part of the official documentation instead of being hidden in the
repo's README.md. Also, remove ancient documentation to deploy with
kubespray a multi-node env.
Also, add a warning to always run tests env in a virtual machine.
Closes: https://github.com/rook/rook/issues/9166
Signed-off-by: Sébastien Han <seb@redhat.com>
By default HPA can use details about memory or CPU consumption for
autoscaling, but also it can use custom metrics as well. There are alot
provides supports HPA via customer and one of them is KEDA project. Here
it is done with help of Prometheus Scaler
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The ingress api version changed when it went to v1, and this has caused some upheaval
throughout the kubernetes ecosystem. This commit uses a common method of deciding which
ingress api to use, and allows the optional override of the kubernetes version
presented to helm using the helm build-in capabilities.
also add an ingress into the helm integration tests so any regressions to how ingresses
are handled in the future are caught easier.
Closes rook#9174
Signed-off-by: Tom Hellier <me@tomhellier.com>
Ceph has recently reported that it may be unsafe to upgrade clusters
from Nautilus/Octopus to Pacific v16.2.0 through v16.2.6. We are
tracking this in Rook issue https://github.com/rook/rook/issues/9185.
Add a warning to the upgrade doc about this.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
From ceph v16.2.6 onwards the vault TLS suppport in RGW was added,
include similar changes for RGW.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The latest docs should link to the master examples on github.
Only the docs were renamed to latest, but not the github branch.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With the recent rename of master docs to the latest docs,
the links from the docs back to github need to be generated
with the latest url instead of master.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The toolbox can now interact with S3 gateways using the `s5cmd` tool.
The binary is only 12M so this does not add up too much to the operator
image size.
Closes: https://github.com/rook/rook/issues/4968
Signed-off-by: Sébastien Han <seb@redhat.com>
We can pass bound_service_account_names with a comma separated list of
service accounts. Let's do this instead of remapping new values.
Earlier, we thought a single service account could be added per Vault
role and we were using other variables like
`VAULT_AUTH_KUBERNETES_ROOK_OPERATOR_ROLE` that we were remapping to
`VAULT_AUTH_KUBERNETES_ROLE` internal for the API calls to Vault.
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit make required changes for ceph csi drivers to work with
ephemeral volume support. With ephemeral volume support a user can
specify ephemeral volumes in its pod spec and tie the lifecycle
of the PVC with the POD.
An example POD spec looks like this:
```
kind: Pod
apiVersion: v1
metadata:
name: csi-rbd-demo-ephemeral-pod
spec:
containers:
- name: web-server
image: docker.io/library/nginx:latest
volumeMounts:
- mountPath: "/myspace"
name: mypvc
volumes:
- name: mypvc
ephemeral:
volumeClaimTemplate:
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: "rook-ceph-block"
resources:
requests:
storage: 1Gi
```
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Blaine Gardner
Sébastien Han
vshinde727
Travis Nielsen
Denis Egorenko
Yuval Lifshitz
subhamkrai
Tom Hellier
Humble Chirammal
Jiffin Tony Thottan
Madhu Rajanna
Satoru Takeuchi