We know append additional information to the rbd-mirror bootstrap peer
token. It is useful for disaster recovery scenario where the other
cluster is reading the peer token and needs to know the pool_id as well
as the namespace.
Signed-off-by: Sébastien Han <seb@redhat.com>
In a production cluster we never should have two mons running on
the same node. However, if two mons have ended up on the same node,
whether from a bug or some other unintentional event, the operator
will evict one of them and failover to a new mon. This only applies
when allowMultiplePerNode is false.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For all Rook-maintained GH actions, use a default shell that has xtrace
enabled to help debug any errors.
Enable xtrace on all actions except these that use only external tools:
- codespell
- commitlint (wagoid/commitlint)
- golangci-lint
- helm-lint (chart-testing)
- stale
- yamllint
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
The operator has very bursty behavior while it is reconciling, then
has much lower resource requirements. We reduce the memory requests to 128Mi
while the limits remain at 256Mi. When not reconciling, the background
health operations are much less resource demanding.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In e8f9cfcb71, the logging was replaced by
Debug which is probably a mistake given the intent of the commit to
enable debug logging on the prepare job.
However, this code is only triggered when running a ceph-osd with the
rook binary, so we must run Info and run Debug since Debug is not
activated.
Signed-off-by: Sébastien Han <seb@redhat.com>
When evaluating the potential "warning" key from the json output we were
not hiding stdout (1) from the output, so the key was leaked. Also the
warning check for the key was not perfect, it only checked for the
command to succeed, but we should introspect it since the "warning" key
is always present unlike the "error" one.
We now only print the warning or the error is present.
Signed-off-by: Sébastien Han <seb@redhat.com>
In pkg/operator/k8sutil/network.go:ApplyMultus(), sort the string
annotations before applying them so that Rook will avoid the situation
where a Deployment or Pod will need updated repeatedly even when no
Multus network configuration has changed.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
We have seen issues with fullchain.pem files containing one self-signed
certificate. At the same time, the failing configuration was not
providing any client certificates or keys.
The error from curl was `"self signed certificate in the chain"`.
The openssl binary is not available so we cannot even c_rehash the
certificate directory when using `--capath`, however this worked already
with a fully signed fullchain.pem along with a client certificate and
key. So we cannot only use `--cacert` which will break that use case.
This is becoming really obscur on why using `--cacert` solves this
problem. I just can't wait to use the `vault` binary, that's all I can
say...
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit moves SetParams and ValidateCSIParam func
into go routine/lock, since it modifies/reads global CSIParam
variable.
Signed-off-by: Rakshith R <rar@redhat.com>
For the TLS communication for AdminOps Api, httpclient is required and
filled with TLS certs, currently it is set to nil pointer in
`buckethealthchecker` and `cephobjectstoreuser`.
Thanks @Krast76 finding the issue even proposing the fix.
Fixes: #8132
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
When the mons are using the dataDirHostPath and not a volumeClaimTemplate,
they need to be permanently assigned to a node. The node assignment
was missing in stretch clusters when the dataDirHostPath was being
used. This resulted in mons that were moving to other nodes for example
during a node drain, which would cause the mon to lose its backing store.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Move MDS related information from the Cluster to the Filesystem document.
Document how resource requests influence Ceph configuration keys.
Signed-off-by: Pedro Lopes <paol@draic.org>
The helm doc example is more natural with the command to directly
create the namespace when needed instead of as a separate command.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The cluster CR name defaults to the namespace where the CR is created.
This name may need to be overridden if the chart is taking over a
cluster that had been previously created with a different name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The CephCluster CR for an existing cluster can be taken over by
the new cluster helm chart if desired, for simpler management
of the RBAC and other resources.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The active osd container was always using /var/lib/rook for the
configuration of the OSD. If the dataDirHostPath is anything other
than the default, the config would show up in the wrong place.
Changing this back to the dataDirHostPath does not appear to affect
any upgrade scenarios as the activate container will simply start
extracting the config to the correct place.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Sébastien Han
Travis Nielsen
subhamkrai
Blaine Gardner
Blaine Gardner
Andy Bursavich
Rakshith R
Jiffin Tony Thottan
Pedro Lopes