Enabling crush updates is false by default, and can be enabled
if set to true. The setting needs to be nullable in case
we need to differentiate between the value being set
to false or just not set, to know if the default should be
different. This is necessary for rook consumers who are
refererencing the pool struct and want to change the default,
rather than using rook's default value of false.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The value of userKey in CSI RBD provisioner secret was set to $CSI_RBD_PROVISIONER_SECRET_NAME because of a typo.
Fixed it by setting it to $CSI_RBD_PROVISIONER_SECRET.
Signed-off-by: Ruben Tsirunyan <rubentsirunyan@gmail.com>
ConfigMap's data are key value pairs where the values must be strings,
so by using the quote function we guarantee that even though the
rendered content would be something like 1.1.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
A `with` block won't render if the argument is falsy, so it behaves like
an `if` block that redefines the `.` context. Using `with` instead of
`if` can help reduce repetition, making things more readable in the
process.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The content wasn't within the `if .Values.csi` block but should be,
however if `.Values.csi` would be falsy, other things in the chart would
break so this shouldn't have affected anyone.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
A `with` block won't render if the argument is falsy, so it behaves like
an `if` block that redefines the `.` context. Using `with` instead of
`if` can help reduce repetition, making things more readable in the
process.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
Instead of having an if block at zero indentation, put it at the level
where its content will be emitted. This is a more modern helm template
practice.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The import-external-cluster.sh script uses $CSI_CEPHFS_NODE_SECRET as the value of userKey when patching the secrets of RBD node, RBD provisioner, CephFS node and CephFS provisioner.
Updated the patch data to use $CSI_RBD_NODE_SECRET, $CSI_RBD_PROVISIONER_SECRET, $CSI_CEPHFS_NODE_SECRET, $CSI_CEPHFS_PROVISIONER_SECRET respectively.
Signed-off-by: Ruben Tsirunyan <rubentsirunyan@gmail.com>
Implement CephX key rotation for Rook's client.admin user.
Admin user rotation is risky, so this has been tested extensively both
in unit tests as well as by manually injecting failures during runtime.
In testing, all failures were able to be recovered by the recovery
routine.
A mutex is also added to help ensure that two simultaneous admin key
rotation processes cannot be running simultaneously for any given
namespace. The mutex is tested in unit tests, and it was verified during
runtime via manual testing.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
this commit add check to only run the csi-operator in
all the canary tests and upgrade suite only, other suite
like smoke and object will still test csi-driver.
Also, adding changes to make CI happy.
Signed-off-by: subhamkrai <srai@redhat.com>
Co-Authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: subhamkrai <srai@redhat.com>
The securityContextConstraints require setting whether
host networking and host port access is needed by the
ceph cluster service accounts. The helm chart now allows
enabling this mode with the settings:
rook-ceph chart: useOperatorHostNetwork: true
rook-ceph-cluster chart: cephClusterSpec.network.provider: host
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CSI operator requires the SecurityContextConstraints to
be configured for the service accounts that have a different
name from the previous CSI driver, both via the manifest install
and the helm install.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
Rotate fs mirror daemon cephx keys based on the cephXconfig in the
cephcluster spec and also update the fs mirror status with the latest
cephxStatus
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
updating the csi operator API version
to latest version.
Adding the cephFS and RBD controllerPublish
secret that are required for the fencing
operation that is supported by ceph-csi
with csi-operator.
Updated the storageclass to include the
secrets incase if user wants to override
the defaults in the clientProfile for
new PVC's.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
csi never used adminID and adminKey for the
rbd secrets, This currently looks to be a
bug where we are creating the secret with userID
and userKey but updating it with adminID and
adminKey, This commits update the script to
use userID and userKey for RBD secrets.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
cephCSI already deprecated the adminID and
adminKey keys in the secrets and to be backward
compatible it still supports the adminID and
adminKey but it logs the warning, updating the
secrets created by Rook to use userID and userKey
instead of adminID and adminKey.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
rotate the client.rbd-mirror-peer key based on the cephxconfig.
Also update the cephxStatus in the cephcluster as well as the
mirrored cephblockpool.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
rotate RBD mirror daemon keys, add secret resource version to the mirror
deployment and update the mirror resource status after the key is
rotated
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
The `CephBlockPool` CR allowed any algorithm to be specified in
`spec.erasureCoded.algorithm`, but in practice only `isa` or `jerasure`
would work.
Make that restriction explicit by restricting this field to `isa` or
`jerasure` in the CRD.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
Travis Nielsen
Blaine Gardner
Ruben Tsirunyan
subhamkrai
parth-gr
Erik Sundell
Michael AdamandTravis Nielsen
Praveen M
subham rai
Santosh Pillai
Madhu Rajanna
Niels de Vos
CL0Pinette
Oded Viner
Benoît Knecht