Update the ceph cosi driver image to v0.1.1, so that it can
work on both amd and arm platforms.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Gateways that do not run the sync threads should not be accessible from one of
the Zone endpoint. If this is the case, the synchronization might stop working.
When the CephObjectStore has the option
`spec.gateway.disableMultisiteSyncTraffic` set to `true`, we must ensure that
the objectstore endpoint is not present in the Zone endpoint.
Signed-off-by: Lucas Henry <polyedre@disroot.org>
The controller was attempting to delete the cosi driver
again and again, always failing the reconcile when the
driver did not exist. Since the desired state is for the
driver not to exist when disabled, return a successful
reconcile.
Signed-off-by: travisn <tnielsen@redhat.com>
Adding CephCOSIDriver CRD and controller. The controller will bring up
the ceph cosi driver when first object store is created in the rook
operator namespace. Then admin can defined COSI CRDs like BucketClass
and BucketAccessClass for different object stores deployed via Rook.
Using the BucketClass and BucketAccessClass, user can define
BucketAccess for backend bucket in the RGW. The CephCOSIDriver CRD
defines configuration options for ceph cosi driver. In the first version
its usability is minimal. Even if it is not defined Rook will bring up
the ceph cosi driver with default values.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Some users want to deploy two CephObjectStores for a single Zone. The first
configures RGWs to process the synchronization of the data, while the second
CephObjectStore configures the client RGWs.
Currently, this can be implemented by setting the RGW option
'rgw_run_sync_thread' in the 'rook-config-override' ConfigMap, though it is not
really user friendly.
Ref: https://docs.ceph.com/en/latest/radosgw/config-ref/#confval-rgw_run_sync_thread
This commit adds a new option in the CephObjectStore CRD as defined in issue
https://github.com/rook/rook/issues/12272. The new option
'disableMultisiteSyncTraffic' determine whether the operator should disable the
multisite sync threads for the RGWs.
If the option is set to 'false', or if the option is not specified, the operator
does nothing. This ensures that the multisite sync threads will not be enabled
for users that disabled explicitely the multisite sync threads either manually
or with the 'rook-config-override' ConfigMap.
This commit also recommends to use two objectstore when scaling Ceph Objectstore
Multisite replication, with one objectstore configured with disabled replication
traffic.
Signed-off-by: Lucas Henry <polyedre@disroot.org>
During faster node loss recovery,
Rook needs to check and blocklist only rbd pvs
that do not support multinode access modes such as
ReadOnlyMany(ROX) and ReadWriteMany(RWX).
This commit adds check for the same.
Signed-off-by: Rakshith R <rar@redhat.com>
in the existing node watcher, we'll check for node update
event and see if there are `out-of-service` taints are applied
and `ROOK_WATCH_FOR_NODE_FAILURE` is enabled in rook-ceph-operator-configmap,
if then we'll create the networkFence cr and delete the cr if nodes come back.
And, added the unit test too.
Signed-off-by: subhamkrai <srai@redhat.com>
adding drop `ALL` capabilities in rook operator container
as this is not required and will remove warning in ocp cluster.
Signed-off-by: subhamkrai <srai@redhat.com>
This commit removes code related to betav1CsiDriver
since minimum k8s version support by rook is now
k8s v1.22 which does not support betav1 csi driver crd.
Signed-off-by: Rakshith R <rar@redhat.com>
This commit removes k8s version check for oidc token
which required k8s v1.20 or above since minimum
k8s version that rook supports now is v1.22.
Signed-off-by: Rakshith R <rar@redhat.com>
Currently the holder daemonset is never updated
which will leaves the images the daemonset also
not updated. we should update the daemonset
template but not restart the csi holder pods
which causes the CSI volume access problem,
set the updateStrategy to OnDelete (already set in
yaml files) which allow us to update the holder
daemonset but not restart/update the pods, when a
pod is deleted or node is rebooted
the new changes will take effect.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
users & buckets admin capabilities aren't spelled the same
way between rook crd (singular) and ceph (plural). It's a bit
misleading when comparing ceph admin cap and rook users.
Signed-off-by: Peter Goron <peter.goron@gmail.com>
The bucket health checker was removed in 1.10. Now in 1.12
we no longer need this removal of the bucket health
checker since it will no longer exist to remove.
Signed-off-by: travisn <tnielsen@redhat.com>
If the ceph version does not suppport the exporter, the operator
will attempt to delete the service monitor related to the exporter
to ensure it does not exist for a node. If the expected rbac does
not exist, this will cause unnecessary errors since there would anyway
be no service monitor to delete. So we ignore the error of deleting
the service monitor for the exporter.
The context is also passed to the exporter so a new kubeconfig does
not need to be initiated and cause unnecessary logging about
invalid options for the config.
Signed-off-by: travisn <tnielsen@redhat.com>
When creating a CephObjectStoreUser with a value spec.store that refers to an
unexisting CephObjectStore, after the reconciliation loop the
CephObjectStoreUser is in the ReconcileFailed state. However, a
ReconcileSucceeded event is created with this message:
"successfully configured CephObjectStoreUser"
The success message results of the return value for the error which is currently
`nil`. Let's replace it with the error message.
Signed-off-by: Lucas Henry <polyedre@disroot.org>
This PR makes Rook operator to add a label on PVC that contains an image version of Ceph when creating an OSD.
Signed-off-by: YZ775 <yuzuki-mimura@cybozu.co.jp>
We add a new field domainName to the Kerberos section. The field is used
to setup /etc/idmapd.conf with the domain name. This allows idmapper to
map to kerberos credential to the correct uid/gid.
We add Spec.Security.Kerberos.DomainName to the CRD
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
There is no reference for ssl in cephobjectstore Secret, so users won't
have much idea why tls secret need to used. Hence give reference
object stores tls secret ref in the Secret.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: avanthakkar <avanjohn@gmail.com>
Volume "ceph-daemons-sock-dir" is coming empty in case if dataDirHostPath,
which is the case for osd onPVC. Fix the volume creation by using the
ceph cluster spec dataDirHostPath, which allows to run socket commands
on osd containers.
Cleanup exporter daemon even if ceph version is not supported along with other resources like
metrics service and service monitor.
Signed-off-by: avanthakkar <avanjohn@gmail.com>
enable flags with --default prefix for --log-to-stderr, --mon-cluster-log-to-stderr, --err-to-stderr, and --log-stderr-prefix
Signed-off-by: Javier <sjavierlopez@gmail.com>
When deploying a cluster with Helm Chart, if the namespace is not the default value `rook-ceph`, and if the monitoring feature is enabled, then the generated ServiceMonitor's `rook_cluster` selector now follows the namespace, not the hard-coded value `rook-ceph`.
Signed-off-by: Ho Kim <ho.kim@ulagbulag.io>
The radosgw-admin command uses the network spec from ceph cluster spec
in object context but it is not filled properly in the object package.
But with PR 10898, network spec is available in clusterinfo which can
be used directly. Also removed cluserspec from object context.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Blaine Gardner
sp98
Jiffin Tony Thottan
Lucas Henry
travisn
Javier
Rakshith R
subhamkrai
Madhu Rajanna
Peter Goron
YZ775
Sachin Prabhu
Tarun Gupta Akirala
avanthakkar
Ho Kim
Blaine Gardner