Ceph-CSI supports LUKS encryption for RBD volumes.
This commit adds support for the same by adding capability
of mounting required `rook-ceph-csi-kms-config` configmap
into csi-rbdplugin-provisioner and nodeplugin pods.
Required documentations, helm charts and examples yamls
are also updated.
Resolved: #7032
Signed-off-by: Rakshith R <rar@redhat.com>
Removed v3.4.0 as its deprecated in cephcsi
and updated the templates to point to latest
v3.6.0 release.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This oidc-token is used to authenticate with OpenID Connect (OIDC)
Provider. Currently, Ceph-CSI uses it to assume role with amazon STS
to get access to aws kms for encryption.
Signed-off-by: Rakshith R <rar@redhat.com>
If the csi driver was enabled at a later time, the mon endpoints
would not be populated. The populate the csi config, either a new
cluster reconcile or restarting the operator would be necessary.
It is simpler just to update the csi configmap with every reconcile
even if the csi driver is not enabled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
If the pod namespace was not found by the csi helper to update
the mon endpoints configmap, the reconcile was failing. To allow
for the update to continue in unit tests and ignore the env var,
we only log the warning instead of failing the reconcile.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Currently, the admin/user can configure the ceph.conf
for daemon pods using https://rook.io/docs/rook/v1.7/
ceph-advanced-configuration.html#custom-cephconf-settings.
This the above custom ceph.conf is only for ceph pods.
the support to provide constom ceph.conf for cephcsi
is added in cephcsi PR 2476
This PR adds the support to create/update
ceph.conf for csi pods.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit modifies ceph-csi controller to be able to cleanup
ceph-csi deployment,daemonset,services & csidriver objects
when no cephcluster exists.
It makes the following changes:
- redundant check for tp.DriverNamePrefix is removed.
- retry to start drivers within reconcile loop is removed,
controller will retry in case of error now.
- stopDrivers() will now return error in case of failure.
- predicate delete func will now respond to cephcluster deletion.
- CSI resources will be cleaned up when cephcluster does not exist.
Fixes: #9697
Signed-off-by: Rakshith R <rar@redhat.com>
updating the csi-snapshotter and dependencies
to v5.0.1 released version.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit updates the csi-addons image version
from v0.1.0 to v0.2.1.
Also, this updates the staging path from
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/pv/ to
{{ .KubeletDirPath }}/plugins/kubernetes.io/csi/.
This changes is done as the reclaimspace on block mode
was not working.
For more details:
https://github.com/csi-addons/kubernetes-csi-addons/pull/97
Signed-off-by: yati1998 <ypadia@redhat.com>
The rook-ceph-csi-config config map now includes CephFS subvolumegroups
when a subvolumegroup CR is created. It is useful for ceph-csi to
understand which subvolumegroup to use for a given cluster.
Signed-off-by: Sébastien Han <seb@redhat.com>
Previously, we were ignoring configuration changes coming from the
operator's pod env variables. We were assuming most users were using the
operator configmap "rook-ceph-operator-config" but most Helm users
don't. Now we will reconcile if a cephcluster is found during a CREATE
event (can be an operator restart or a cephcluster creation) AND no
"rook-ceph-operator-config" is found which means the operator's pod env
var are used.
Also, unit tests have been added (long due) for the predicate!
Closes: #9602, #9487, #9579
Signed-off-by: Sébastien Han <seb@redhat.com>
Below sidecars are updated to the latest releases with this commit.
csi-provisioner : 3.1.0
csi-attacher : 3.4.0
node-driver-registrar: 2.4.0
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Rook does not support running multiple clusters in the same namespace,
so the operator should not reconcile if a new cluster is added.
The scenario where a cluster is added while the operator is down is also
handled. CR updates are also handled.
When the operator detects more than one cluster it will refuse to
reconcile the CephCluster, and child CRDs will block too until the
operator is ready.
The user must remove one of the clusters before can continue to perform
any reconcile.
Closes: https://github.com/rook/rook/issues/9452
Signed-off-by: Sébastien Han <seb@redhat.com>
The built-in pools device_health_metrics and .nfs created by ceph
need to be configured for replicas, failure domain, etc.
To support this, we allow the pool to be created as a CR.
Since K8s does not support underscores in the resource names
the operator must translate this special pool name into
the name expected by ceph.
This also sets the basis for allowing filesystem data
pools to specify the desired pool name instead of requiring
a generated name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit adds context parameter to k8sutil service functions. By
this, we can handle cancellation during API call of service resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit introduces a new configuration option for
ceph csi driver to enable hostpath mounting of /etc/selinux
directory from the cluster node where csi plugin pods are
running, which inturn help the csi driver to specify
selinux-related mount options like context.
Ref# https://github.com/ceph/ceph-csi/issues/2295
The default value for this configuration is true and if cluster
nodes are running without selinux enabled, an admin can deploy
csi pods by specifying this option to `false` which skip the
host path mounting for the csi pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
The cluster info is important context for the cluster controller to
create the cluster, and all the fields must be properly set.
A test cluster name was being set temporarily, resulting in
mons incorrectly getting the wrong cluster CR name. There is no
known issue from the temporary value, it was just exposed by
https://github.com/rook/rook/pull/8678 setting the value to a label.
Now the functions are more clearly named so only unit and
integration tests should be using the test value for the cluster
name where it is not important.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit adds context parameter to k8sutil job functions. By this, we
can handle cancellation during API call of job resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil daemonset functions. By
this, we can handle cancellation during API call of daemonset resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit adds context parameter to k8sutil deployment functions. By
this, we can handle cancellation during API call of deployment resource.
Signed-off-by: Yuichiro Ueno <y1r.ueno@gmail.com>
This commit makes sure csi provisioner node-affinity is applied
to the csi version check job as well, similar to the how
the existing csi provisioner toleration is applied to the job.
Fixes: #8323
Signed-off-by: Rakshith R <rar@redhat.com>
The CSI controller loop watches ConfigMaps and CephClusters. When a
CephCluster triggers the reconcile loop, the Get call for the ConfigMap
will fail since the name in the request object is that of the
CephCluster. Setting the name and namespace to the constants for the
ConfigMap name and the operator namespace resolves this.
Closes: https://github.com/rook/rook/issues/8958
Signed-off-by: Renan Campos <rcampos@redhat.com>
In Rook v1.8 the min version of K8s supported is updated to 1.16.
Users running on older versions of K8s are recommended to update
to 1.16 or newer before updating to Rook v1.8.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
As like RBD, CephFS provisioner pod need not to
run as privileged. as its not doing any operation
like plugin pods which does mounting and unmounting
removing the permissions for the same.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
added new option to set the provisioner replicas.
with this new option the user/admin can choose
how many replicas he want for provisioner pod if
number of nodes is greater than 1.
fixes#8153
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
With the release of Ceph CSI 3.4.0, Ceph CSI project came up
with a new support policy where we support only versions >= 3.3.0
The supported window of Ceph CSI versions is known as "N.(x-1)":
(N (Latest major release) . (x (Latest minor release) - 1)).
For example, if Ceph CSI latest major version is 3.4.0 today,
support is provided for the versions above 3.3.0.
If users are running an unsupported Ceph CSI version, they will be
asked to upgrade when requesting support for the cluster.
This PR lift the minimum supported version of Ceph CSI to 3.3.0
in this repo.
Fix https://github.com/rook/rook/issues/8709
Ref #
https://github.com/ceph/ceph-csi/releases/tag/v3.4.0https://github.com/ceph/ceph-csi/#known-to-work-co-platforms
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
This commit is a large refactor on how the operator starts, stops and
how it starts various sub-components such as the ceph-csi driver. It
also refines the way we cancel orchestrations. We don't use breakpoints
anymore but send our self a SIGUP to reload our controller runtime
manager.
The reload will happen under different circonstances like:
* a new adminission controller secret is created/deleted/changed
* a CephCluster CR is edited
As mentioned earlier, the csi driver now has its own controller, just
like flex. It reacts to change in the operator config map for particular
ROOK_CSI_ fields.
A second new controller for the operator's general config has been
created, it manages:
* the logging level
* the ceph CLI command timeout
* the discovery daemon
The operator reacts much more rapidly to cancellation events by stopping
the manager's context and reloading it.
Signed-off-by: Sébastien Han <seb@redhat.com>
We don't need to use github.com/ghodss/yaml since
"k8s.io/apimachinery/pkg/util/yaml" provides the same functionality and
we already import it.
Signed-off-by: Sébastien Han <seb@redhat.com>
During disaster recovery/migration of a cluster, as part of the failover, the
kubernetes artifacts like deployment, PVC, PV, etc will be restored to a new
cluster by the admin. Even if the kubernetes objects are restored the
corresponding RBD/CephFS subvolume cannot be retrieved during CSI operations as
the clusterID and poolID are not the same in both clusters
This PR creates a mapping between Cluster ID and RBD Pool ID between
local cluster and peer cluster.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Thanks to Golang 1.16, we can now embed files in the Go binary. This
means we don't need to add the CSI templates files to the container
image. They are added in the Go binary at build time.
The existing location of the template must be in the package calling it.
So they moved to pkg/operator/ceph/csi/template. All the files have been
symlinked back to cluster/examples/kubernetes/ceph/csi/template.
Closes: https://github.com/rook/rook/issues/7609
Signed-off-by: Sébastien Han <seb@redhat.com>
Rakshith R
Madhu Rajanna
subhamkrai
Travis Nielsen
Divyansh Kamboj
Tom Hellier
Mathieu Parent
yati1998
Sébastien Han
Humble Chirammal
Yuichiro Ueno
Renan Campos
Santosh Pillai