this commits updates the go version to 1.22.2 in govulncheck ci and
also updates golang.org/x/net to v0.23.0 to fix the ci
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit f063e8fe39)
Signed-off-by: subhamkrai <srai@redhat.com>
The key file deletion process is in the shell script commonly used by
all of encryption-open, encryption-open-metadata, and
encryption-open-wal init containers. The key file is deleted at the
encryption-open init container and encryption-open-metadata and
encryption-open-wal init containers are failed to open the key file.
The key file is in the /etc/ceph folder. Unless that folder is shared,
the key file anyway won't be available in the other init containers
even if it is not deleted by these init containers. And it will
naturally anyway be deleted after the init containers are
completed. So The key file deletion process in shell scripts is
unnecessary.
Fixes: #13737
Signed-off-by: Yuma Ogami <yuma-ogami@cybozu.co.jp>
(cherry picked from commit cdd655ed3f)
synk security check is failing and it requires
go-jose v3.0.3 or later version.
Signed-off-by: subhamkrai <srai@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
the labels listed under the 'monitoring' section are currently only
being applied to the rook-ceph-mgr ServiceMonitor. This change extends
those labels to also include the rook-ceph-exporter ServiceMonitor.
Fixes: https://github.com/rook/rook/issues/13774
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit 10e26709c4)
With the release of Reef v18.2.2 we update the default
recommended version of Ceph to fix the prometheus issues
seen with v18.2.1
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 026d745f8a)
During cluster creation, csi config map was first filled with
mon ips and without CSIDriverOptions.
This commit makes sure CSIDriverOptions are added at the begining
when the entry is first created.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 330f604cca)
# Conflicts:
# pkg/operator/ceph/csi/cluster_config.go
# pkg/operator/ceph/csi/cluster_config_test.go
cephFs fencing needs more testing and bug fixes to make
it in production. We tried multiple fixes but still it need
more work. So, removing the cephfs networkFence realted code
will rever this commit when we start working on this again.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit bd4250f56e)
earlier, we were only checking the specs of networkFence to see if
unfencing is done before proceeding with deletion but we should also
check the status of networkFence before proceeding with deletion.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 0ace7cf8cf)
If the spec.mon.count is 5 or more, then create
mon pdbs with maxUnavailable count as 2. We can
afford to have more than 1 mons down while
draining the nodes in this case.
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit a4866b4b06)
Reduce CRD size by removing some descriptions for things that
(a) are long, (b) are repeated, and (c) are commong kubernetes types.
Remove the `Status` field from VolumeClaimTemplates (a.k.a. PVCs) in
types.go to remove all unnecessary status-related fields.
Use `yq` to go through generated `crds.yaml` to strip out descriptions
for well-known k8s types that are long and repeated where we can't
remove them from types.go. This is mostly placement descriptions and
volumeSource descriptions.
The overall `crds.yaml` file is reduced to less than 60% of its original
size.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
Co-authored-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit bd7477ec61)
# Conflicts:
# deploy/charts/rook-ceph/templates/resources.yaml
# deploy/examples/crds.yaml
The crush rule will be updated when the failure domain changes.
This update can be skipped when the expected crush rule is
already configured. Otherwise, the log has a confusing message
that makes it appear that the crush rule was updated
when in fact it was not.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 90bec31203)
retry other cephfs/rbd pvc if there
are no active clients found on ceph cluster.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit ca21bd9715)
to keep the code consistent and to propogate
more details about error rook uses error wraping.
updating current code whereever its required to
wrap the details.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit eb97390df2)
The cephfs PVC might exist on the kubernetes
node object but due to some timing issues the
ip might not be visible on the ceph cluster or
the client might already got evicted or disconnected
from ceph cluster. In this case we will not be
able to get IP details for the subvolume and we dont
have any check for empty ip's in the code and rook
tries to create NetworkFence CR with empty Ip's
and the NetworkFence will get moved to the Failed state.
This PR adds the necessary check and logging to prevent
this one.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit 0e115c44bf)
since networkFence is a cluster-based resource so that we don't need
the namespace and ownerReferences as it cause garbage-collector errors.
Also, now we create the networkFence with clusteUID label so when doing
cleanup we match the cephCluster uid and networkFence label clusterUID.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 5bff860380)
Mgr sidecar was using a privileged security context because it needed
to create the /var/lib/rook directory, generate the config on it, and
then copy it to the /etc/ceph directory. This change creates empty
directories on /var/lib/rook and /etc/ceph so the mgr sidecar can use
them, removing the need for using a privileged security context.
Fixes: https://github.com/rook/rook/issues/13719
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit db4b3322fa)
Fixes: #13692
Since the introduction of the "host" network provider, the legacy
"hostNetwork" setting is intended to be used only in combination with
the default network provider (""), but the code did not enforce this.
This change adds the required validation checks to throw errors
in invalid constellations.
These checks are added both in the operator's input validation code
and as kubernetes x-validation admission policies in the Cepcluster CRD.
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 25aa15e6c1)
Updating the cephcsi image to 3.10.2
which is the latest released one.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit c22597a32c)
Currently, when rook provisions OSDs(in the OSD prepare job), rook effectively run a
c-v command such as the following.
```console
ceph-volume lvm batch --prepare <deviceA> <deviceB> <deviceC> --db-devices <metadataDevice>
```
but c-v lvm batch only supports disk and lvm, instead of disk partitions.
We can resort to `ceph-volume lvm prepare` to implement it.
Signed-off-by: Liang Zheng <zhengliang0901@gmail.com>
(cherry picked from commit ee05e82cea)
since networkFence is a cluster-based resource so that we don't need
the namespace and ownerReferences as it cause garbage-collector errors.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 2ac418a3b2)
The validation logic of checking the number of devices is
wrong when `metadataDevice` is set and `osdsPerDevice` > 1.
`len(cvReports)` is the expected number of OSDs and is
the number of specified data devices multiplied
by `osdsPerDevice`.
Closes: https://github.com/rook/rook/issues/13637
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
(cherry picked from commit 753bbfe1c4)
When `managePodBudgets` is enabled, the Rook operator sets a blocking
PDB by considering the failure domains of the OSDs. This functionality
is implemented by `reconcilePDBsForOSDs`, and it sets the PDB only after
unhealthy PGs appear. However, there are no unhealthy PGs when an OSD
with no PGs becomes down. In this case, the PDB is never enabled.
This PR makes the operator configure the blocking PDB without waiting
for the unhealthy PGs to appear. This PR solves the above problem
because the blocking PDB is always enabled when a down OSD is detected.
Signed-off-by: Ryotaro Banno <ryotaro.banno@gmail.com>
(cherry picked from commit 6def9c8e30)
If the configmap rook-config-override is empty,
there is no need to trigger the reconcile to update
the ceph daemons. This configmap update is causing
unnecessary reconciles periodically in some clusters
even when it is empty.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 0240ee8563)
this commit updates the name of network fence CR to
node name + driver name, which will allow the creation of
multiple network fence per drivers on the same node, and
modifies the unit test and deletion procedure for the
same.
Signed-off-by: Riya Singhal <rsinghal@redhat.com>
(cherry picked from commit c2e3cf367c)
The name for cephcosi driver should be ceph-cosi-driver and namespace
should same as the rook operator. Otherwise request need to be failed.
Fixes: #13025
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
(cherry picked from commit 5b5e1c0292)
Corrected the NetNamespaceFilePath generation in the
subvolumegroup & radosnamespace controller by replacing
the cephCluster.Name with cephCluster.Namespace.
Signed-off-by: Praveen M <m.praveen@ibm.com>
(cherry picked from commit 67ff924b57)
The exporter service and service monitor should not
be deleted if an individual daemon is being removed
from a node. As long as the exporter is enabled with
v18 and newer, the exporter service and service monitor
should exist. Clusters were seeing their metrics stop
collection when the exporter service and service monitor
would disappear, especially when multiple clusters are
configured.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit a1fc70f2fc)
previous code was calling the following command to create the
dashboard user:
> ceph dashboard ac-user-create <username> -i <password-file>
this works the first time when the user doesn't exist, however subsequent
calls for example when the password has changed or when the secret was
deleted from k8s, will not take place as this command will succeeded
because the user already exists but the password is not updated in
this case. The fix consists in adding an explicit call to the command:
> ceph dashboard ac-user-set-password <username> -i <password-file>
which ensures the password is updated correctly in the access control db
Fixes: https://github.com/rook/rook/issues/13594
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit cb028f3a28)
there was a bug in the code which doesn't
sets realm if we try to get the zonegoup
so because of that 1.12 this backport pr
for original change was not working
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit a9c77280c6)
The changes made to cosi driver are reflected. Add the cosidriver crd to
predicate workflow.
Fixes: #12545
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
(cherry picked from commit 3da2331fa3)
For now we are using the operator namespace name
as the prefix for the csi driver, This PR provides
an option for the users if someone wants to have
their own prefix for the csi driver, if someone tries
to change the prefix for existing csi driver rook
operator will fail to reconcile the csi driver.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit c35a8532aa)
we dont set removeMgrDaemonConfiguration to true unless all the
delete operations went successfull.
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit 39c06d2fa5)
previously, the dashboard parameters supported by Rook were stored in the
daemon configuration section (mgr.X, for example). This differs from
Cephadm-based deployments, where all configurations are stored in the
global mgr configuration section. This variance could result in
configuration mismatches between the active and standby dashboards.
Furthermore, all Ceph dashboard documentation exclusively points to
the global mgr configuration section and makes no use of individual
daemons sections.
Fixes: https://github.com/rook/rook/issues/13577
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
(cherry picked from commit 57e3937d40)
If migration of the OSDs is enabled, operator should wait
for the pgs to be clean after the all the OSDs have reconciled.
This will help add the exponential backoff for the operator
restarts when OSD migration is needed but PGs are still rebalancing the
data after last OSD migration.
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit 43d3bf147a)
The exporter pod is ephemeral and frequently being deleted
and re-created when ceph daemons are created. Therefore,
we need to skip reconciling based on the deletion
of the exporter deployment.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 995a64fb3a)
subhamkrai
Travis Nielsen
Yuma Ogami
Redouane Kachach
mergify[bot]
Rakshith R
Madhu Rajanna
sp98
Michael Adam
Liang Zheng
Satoru Takeuchi
Ryotaro Banno
Riya Singhal
Jiffin Tony Thottan
Praveen M
parth-gr