Fix a small permission (RBAC) issue with the operator-on-openshift.yaml
example's SecurityContextConstraint. A ServiceAccount reference for the
Ceph CSI NFS provisioner was missing.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
setting the GRPC timeout configurable helps
in some cases where ceph cluster takes more time
to respond.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Update the NFS docs with the latest available info for Ceph Quincy
including the CSI provisioner driver.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Ceph-CSI supports LUKS encryption for RBD volumes.
This commit adds support for the same by adding capability
of mounting required `rook-ceph-csi-kms-config` configmap
into csi-rbdplugin-provisioner and nodeplugin pods.
Required documentations, helm charts and examples yamls
are also updated.
Resolved: #7032
Signed-off-by: Rakshith R <rar@redhat.com>
Because the NFS CSI driver is optional and rarely deployed, make RBAC
for this driver an optional example that is generated by the helm chart.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Create the ".nfs" config pool by default so that users aren't required
to create it via CephBlockPool.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Adds support for valid arbitrary NodeAffinity JSON input by the user while
maintaining backward compatibility with the older parsing code.
Signed-off-by: Pranshu Srivastava <rexagod@gmail.com>
This new integration test will deploy a cluster with multus enabled. It
will be comprised of two network interfaces for ceph public and cluster
communications.
For now, it only deploys a Ceph cluster up to the OSDs.
Closes: https://github.com/rook/rook/issues/9784
Signed-off-by: Sébastien Han <seb@redhat.com>
finally, admission controller will be enabled default
without any script/manual step. But it still requires cert-manager
to be installed which I believe is already installed in clusters.
**Note**
Code doesn't return error it just logs the error since
we don't want to stop reconciling if the admission controller fails.
We can work on this once the admission controller is stable.
Signed-off-by: subhamkrai <srai@redhat.com>
The default replica count for test clusters should be 1.
This was causing the rgw-multisite integration test to
fail because the PGs were attempting to use the default
replication instead of the replication of 1 expected
for test clusters.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When the prometheus rules are created, if external settings
were not specified, the helm chart would fail due to a nil ref
in the external settings. Now we check both for the existence
of external settings and whether the external settings are enabled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CSI driver pods dont need to update the node objects for
its operations. This commit remove the unwanted access to node
object update in the RBAC of CSI pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Update upgrade and supporting docs for release of Rook v1.9.
Include pending release notes as part of this update.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Removed v3.4.0 as its deprecated in cephcsi
and updated the templates to point to latest
v3.6.0 release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
In the `object-openshift.yaml` details about exposing `Routes` for RGW
service, currently it exposes both ports if they are available. This is
very difficult to manage via same route like adding termination policy
etc.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Corrected RGW_ADMIN_OPS_USER_ACCESS_KEY and
RGW_ADMIN_OPS_USER_SECRET_KEY so it should be
output correctely when called script with
bash format output
Signed-off-by: parth-gr <paarora@redhat.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
For supporting features like service account authentication for vault
KMS , a service account account need to attach with pod.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Corrected CSI_RBD_NODE_SECRET name so it should be
output correctely when called script with
bash format output
Signed-off-by: parth-gr <paarora@redhat.com>
pylint was failing with used-before-assignment error
fixed it by making the variables assignmet before it was used
Also backward compatibility is removed from the ModuleNotFoundError import,
as we auto installed python3 version on ceph standalone
Signed-off-by: parth-gr <paarora@redhat.com>
This commit fixes the missing indentation for nodeAffinity configuration
example in the comment. If users try to use the example configuration by
copy and paste, an error will occur.
Signed-off-by: Kazuki Suda <kazuki.suda@gmail.com>
The aws go lang sdk needs value for region, it is set differently in
various part of current code. With PR the value is always `us-east-1` so
that it will work RGW server without any issues.
This reverts commit 280c29f330.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The prometheus rules had been previously created if the cephcluster CR
setting monitoring.enabled was set to true. The rules were not customizable
and therefore not flexible enough. Now the rules are installed by the helm
chart. To customize the rules, a post-processor can be applied to the helm
chart.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
log1cb0mb
Blaine Gardner
Madhu Rajanna
Rakshith R
Pranshu Srivastava
Sébastien Han
subhamkrai
Humble Chirammal
Jiffin Tony Thottan
parth-gr
Kazuki Suda
Yuval Manor