in endpoint slice for the mgr and rgw service
it was harcoded to use the ipv4,
now dynamically assign the type based on the endpoint
ip adrress type
Signed-off-by: parth-gr <partharora1010@gmail.com>
For all of the controllers besides the cluster controller,
the logging now includes the namespaced name of the resource
that is being reconciled. This will help with log troubleshooting
to help analyze logs consistently for the resource being
reconciled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
The logger names are seen on each line of logging. As
long as they are unique, they really don't need to be
long and descriptive, so let's make them a bit more
concise, and independent from controller names.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
obc was using an internal exponential backup for the lookup of the sc.
This is somewhat of an anti-pattern when using controller-runtime as it
implements retrying logic. If the sc doesn't exist, the reconcile
attempt should fail immediately and controller-runtime will handle the
back-off policy.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
A typo was causing the operator to attempt to sync bucket policy when
the state was already in sync. This resulted in the operator carrying
out unnecessary work and logging activity with no user visible change
resulting.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add RecoverAndLogException() helper to log panics with stack trace.
added defer call in all rook controller Reconcile() methods for
better error visibility in operator logs
Signed-off-by: Oded Viner <oviner@redhat.com>
This change updates the codebase to replace the deprecated
v1.Endpoints API with discoveryv1.EndpointSlice.
The v1.Endpoints API has been deprecated in Kubernetes v1.33+
Signed-off-by: subhamkrai <srai@redhat.com>
skip key generation during reconcile if CephObjectStoreUser is
being deleted to allow cleanup when referenced secret is missing
Signed-off-by: Oded Viner <oviner@redhat.com>
This change addresses a permission issue where mon pods crashloop
on some Kubernetes setups with SELinux enabled, even when
ROOK_HOSTPATH_REQUIRES_PRIVILEGED is set.
To resolve this, a new function makeMonSecurityContext() was introduced
to explicitly set runAsUser: 0 at the pod level for mon pods
when the environment variable ROOK_CEPH_MON_RUN_AS_ROOT is set to true.
Additionally, the function previously named PodSecurityContext() was renamed
to DefaultContainerSecurityContext() to avoid confusion between
container-level and pod-level security context configuration. All container
SecurityContext usages across Ceph daemons were updated to reflect this change.
This ensures the root user configuration is applied
automatically and consistently in environments where it is required
for mon pod startup, while preserving clear separation of container
and pod-level security logic.
Signed-off-by: Patryk Rostkowski <patrostkowski@gmail.com>
This is the first implementation of CephX key rotation in Rook.
Adds key rotation API from design PR 15915.
Also add helper methods for rotating keys, determining when keys
need to be rotated, and for generating CephX key statuses. These will be
reusable for other Rook reconciles beyond object/RGW.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This change cleans up and standardizes import statements across the Ceph operator code. It removes redundant or duplicate imports and reorganizes alias names for improved clarity and consistency. Additionally, the ST1019 exception was removed from .golangci.yaml now that the code complies with the rule.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
Refactored multiple conditional if-else blocks into switch statements to improve readability and maintainability. Also removed outdated staticcheck rule comments (QF1002, QF1003) from .golangci.yaml.
Signed-off-by: Carlos Barria <cbarria@yahoo.com>
When multiple `CephObjectStoreUser` CRs are present, the operator logs a
high volume of `CephObjectStore "foo" found` messages during reconcile.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Lower the verbosity of a message in the notification controller's OBC
label watcher. If the OBC controller is having issues provisioning the
OBC, this log will spam every 10 seconds. Reduce the message verbosity
level to debug.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The object store controller was swallowing errors of the
type not found, assuming a certain category of errors
when ceph may still be initializing. But some of these
errors could be user error and they need to troubleshoot
the details of the error, so we need to log the specific
error instead of swallowing it.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
userSecretRef and passwordSecretRef fields are added to allow the Kafka
endpoint username and password to be supplied from a Kubernetes Secret,
rather than exposed as plaintext as part of the endpoint URI. If the
endpoint URI has HTTP basic auth user-id and user-pass components, they
are overridden by userSecretRef and passwordSecretRef.
Squid added bucket topic attributes for configuring the user-name and
password for pushing notifications to Kafka as an alternative to
encoding credentials into the URI. However, these attributes are not
supported under Reef. Thus, this initial implementation relies on URI
mangling for compatible with both Reef and Squid. Future work could
using Ceph version detection and switch to the new attributes to be used
with Squid and/or the implementation could be converted exclusively to
use the new attributes once Rook has dropped support for Reef.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
When finalizers are added to the CRs, a follow-up reconcile
will be triggered due to the increased generation on the CR.
Therefore, abort the initial reconcile when adding the finalizer,
and allow the follow-up reconcile to complete the configuration.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
All existing controller runtime watches are converted to use "typed"
handlers and predicates instead of operating on `client.Object`. The
intent is to be bug for bug equivalent with the existing logic while
replacing run time type assertions and switch statements with compile
time type constraints and type casts. In several cases, functions using
assertions were split up such that each function only handles a single
Kind at a time. It is hoped that this will improve readability and
maintainability while facilitating future refactoring such as migrating
some watches to using IndexFields.
Of particular note is that the massive switch statement in
`WatchControllerPredicate()` from
`pkg/operator/ceph/controller/predicate.go` has been replaced with
generics, reflection, and splitting the obc logic into its own predicate
function. There are still many helper functions operating on
`client.Object`. These were not updated unless required by the compiler
in order to limit the size of this change. The type safety of these
funcs should be improved as followup work.
It is strongly suggested that going forward, handlers and predicates
only handle a single Kind (generic or not) and that switches / type
assertions are heavily discouraged or forbidden. This PR removed all
but a single switch statement in a predicate, which should be addressed
in future work.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
allows selecting Read Affinity policy from the ObjectStore API
aets `--crush-location=host` for RGW daemons.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
topic.reconcile() had a number of error triggered return statements
which did not update the CR's status to reflect a reconcile failure.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Parth Arora
Travis Nielsen
subhamkrai
Joshua Hoblitt
Blaine Gardner
SantoshPillai
cuiweixie
Oded Viner
Artem Torubarov
Santosh Pillai
raaizik
Patryk Rostkowski
Carlos Barria