Fix a small permission (RBAC) issue with the operator-on-openshift.yaml
example's SecurityContextConstraint. A ServiceAccount reference for the
Ceph CSI NFS provisioner was missing.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
setting the GRPC timeout configurable helps
in some cases where ceph cluster takes more time
to respond.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Ceph-CSI supports LUKS encryption for RBD volumes.
This commit adds support for the same by adding capability
of mounting required `rook-ceph-csi-kms-config` configmap
into csi-rbdplugin-provisioner and nodeplugin pods.
Required documentations, helm charts and examples yamls
are also updated.
Resolved: #7032
Signed-off-by: Rakshith R <rar@redhat.com>
Removed v3.4.0 as its deprecated in cephcsi
and updated the templates to point to latest
v3.6.0 release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
For supporting features like service account authentication for vault
KMS , a service account account need to attach with pod.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
```
ReadWriteOnceWithFSType: Indicates that volumes will be examined
to determine if volume ownership and permissions should be modified
to match the pod's security policy. Changes will only occur if the
fsType is defined and the persistent volume's accessModes contains
ReadWriteOnce.
```
In between considering we are giving 0777 permission on nodestage
of cephfs shares, we defaulted to NONE. However giving worldwide
permission to the volume is not the right thing and it has been
fixed in cephfs via https://github.com/ceph/ceph-csi/pull/2847
This commit brings it back to the value which is also in parity
with RBD driver.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
updating the csi-snapshotter and dependencies
to v5.0.1 released version.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit updates the csi-addons image version
from v0.1.0 to v0.2.1.
Also, this updates the staging path from
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/pv/ to
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/.
This changes is done as the reclaimspace on block mode
was not working.
For more details:
https://github.com/csi-addons/kubernetes-csi-addons/pull/97
Signed-off-by: yati1998 <ypadia@redhat.com>
Below sidecars are updated to the latest releases with this commit.
csi-provisioner : 3.1.0
csi-attacher : 3.4.0
node-driver-registrar: 2.4.0
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
This commit introduces a new configuration option for
ceph csi driver to enable hostpath mounting of /etc/selinux
directory from the cluster node where csi plugin pods are
running, which inturn help the csi driver to specify
selinux-related mount options like context.
Ref# https://github.com/ceph/ceph-csi/issues/2295
The default value for this configuration is true and if cluster
nodes are running without selinux enabled, an admin can deploy
csi pods by specifying this option to `false` which skip the
host path mounting for the csi pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Blaine Gardner
Madhu Rajanna
Rakshith R
Jiffin Tony Thottan
Humble Chirammal
Mathieu Parent
yati1998
parth-gr
Sébastien Han