Added a clusterName, poolName , filesystemName, radosNamespace
as a suffix on ceph auth principals for external cluster so
every csi authentication would be unique if
restricted_auth_permission flag is specified.
Closes: https://github.com/rook/rook/issues/9192
Signed-off-by: parth-gr <paarora@redhat.com>
Recently with the directory renaming to "deploy/olm" the CSV name
changed from "ceph" to "olm". Now we are using the same "rook-ceph" name
regardless of the platform.
Signed-off-by: Sébastien Han <seb@redhat.com>
Instead of mixing configuration for different protocols in the gateway
section, depending on the type option, introduce a new section protocols for
API specific configuration.
This allows configuring s3 and swift in one RGW and at the same time
simplifies validation of the CRD and allows for a clean separation of
concerns.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
* add annotations to the examples of new CR fields
* add links to external documentation
* clarify language issues raised in review
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
If helm is not install, `make` fails with the following log.
```console
./build/rbac/get-helm-rbac.sh: line 25: helm: command not found
```
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
the events are used to mark the start/success/failure of the reconciliation
and also to log the bucket names on which the CephbucketNotification is
created
Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
Allow specifying daemon startup probes where we also allow configuring
liveness probes. Startup probes allow Rook to tolerate when Ceph daemons
occasionally take a long time to start up while not also making
Kubernetes liveness probes slower to detect runtime failures of daemons.
Startup probes are beta in Kubernetes 1.18, so we should not enable
probes by default for earlier Kubernetes versions.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This introduces a new CRD to add the ability to create subvolumegroup
for a given ceph filesystem volume. Typically the name of the volume is
the name of the filesystem created by rook.
Closes: https://github.com/rook/rook/issues/7036
Signed-off-by: Sébastien Han <seb@redhat.com>
This is handling a tricky scenario where the OSD deployment is manually
removed and the OSD never reconvers. This is unlikely to happen, but
still OSD should be able to run after that action. Essentially after a
manual deletion, we need to run the prepare job again to re-hydrate the
OSD information so that the OSD deployment can be deployed.
On encryption, it is a little bit tricky since ceph-volume list again
the main block won't return anything, so we need to target the encrypted
block to list.
There is another case this PR does not handle, which is the removal of
the OSD deployment and then the node is restarted. This means that the
encrypted container is not opened anymore. However, opening it requires
more work like writing the key on the filesystem (if not coming from the
Kubernete secret, eg,. KMS vault) and then run luksOpen. This is an
extreme corner case probably not worth worrying about for now.
Signed-off-by: Sébastien Han <seb@redhat.com>
Hybrid pools suffer from lower availability when a node goes down,
so we recommend primary affinity instead of hybrid pools.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The label was on the job, but not on the pod template,
so querying for the pod logs was not working as simply
as if we added the label.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The prior formulation which openrc variables take effect was
ambiguous/contradictory.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Access to the Swift API is granted via subusers. The configuration
of the subusers is added to the cephobjectstoreuser CR.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The integration of Keystone includes HTTPS API calls to Keystone. We
document why the CA bundle used to verify those connections,
can't be explicitly configured and how it can be indirectly configured.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
It is not clear at this moment whether anyone has a use case for this.
As a workaround you can explicitly generate a user and subuser that
can access the bucket created via OBC.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Current approach is to delete all the existing notifcations from bucket
and re-add the notification from the labels.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Rook does not support running multiple clusters in the same namespace,
so the operator should not reconcile if a new cluster is added.
The scenario where a cluster is added while the operator is down is also
handled. CR updates are also handled.
When the operator detects more than one cluster it will refuse to
reconcile the CephCluster, and child CRDs will block too until the
operator is ready.
The user must remove one of the clusters before can continue to perform
any reconcile.
Closes: https://github.com/rook/rook/issues/9452
Signed-off-by: Sébastien Han <seb@redhat.com>
The mons need to be configured to skip the mds sanity check
during upgrade to 16.2.7 or the mons may crash during that
upgrade.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Ceph RGW supports integrating with OpenStack clouds by providing
the Swift object store API and using Keystone for authentication.
The design document describes how the required configuration shall
be mapped to the Object Store CRD.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job
creating pods under PSP-enabled Kubernetes cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
Creating an EC pool is causing the CI to hang when the EC
pool is initialized since there aren't enough OSDs to
satisfy the EC parameters.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
parth-gr
Satoru Takeuchi
subhamkrai
Blaine Gardner
Travis Nielsen
Sébastien Han
Sebastian Riese
Robert Spier
Yuval Lifshitz
vshinde727
Jiffin Tony Thottan
Daniel Ruiz Capilla
Yuichiro Ueno