Due to an oversight, PSP resources were left in generation of
common.yaml from #10797. Resolve that by setting
pspEnable=false when generating common.yaml.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
CephFS CSI driver dont have/advertise controller publish/unpublish
capabilities, thus dont need attacher sidecar for its operations.
The presence of external-attacher adds on overhead and issues wrt
attachment in various scenarios. One of them would be the lack of
performance on syncing volumeattachment from api server..etc.
More or less we don't have controller publish and unpublish capabilities,
so we should not make use of this sidecar and cause
unnecessary addon here thus other issues.
similar changes have been added to CSI
https://github.com/ceph/ceph-csi/pull/3149
Signed-off-by: yati1998 <ypadia@redhat.com>
rbd nodeplugin need volumeattachment RBAC
to remount the volume incase of the nbd driver
is used to mount the volume.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
The `watch` verb is not required for the csi-snapshotter sidecar
to function, removing it from the deployment
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
This commit adds psp RoleBindings to rook-ceph-rgw role and
rook-ceph-purge-osd role. Without this commit, I cannot perform
rook-ceph-purge-osd job on PSP-enabled cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
With https://github.com/rook/rook/pull/10108 a placeholder role
and role binding were added for the rgw service account so
the csv generation would generate the service account. That
workaround also requires a rule to be added to the role or else
the generation is invalid. Now a rule is added to avoid that
issue. In the future we need to remove this role and binding
when the operator sdk is updated as explained in
https://github.com/rook/rook/issues/10141
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The csv will not properly include the rook-ceph-rgw service
account unless there is a role and binding that references
the service account. No roles are needed yet for the rgw
daemon, so this will add a placeholder only for the purposes
of csv generation.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Because the NFS CSI driver is optional and rarely deployed, make RBAC
for this driver an optional example that is generated by the helm chart.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
finally, admission controller will be enabled default
without any script/manual step. But it still requires cert-manager
to be installed which I believe is already installed in clusters.
**Note**
Code doesn't return error it just logs the error since
we don't want to stop reconciling if the admission controller fails.
We can work on this once the admission controller is stable.
Signed-off-by: subhamkrai <srai@redhat.com>
The CSI driver pods dont need to update the node objects for
its operations. This commit remove the unwanted access to node
object update in the RBAC of CSI pods.
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
This introduces a new CRD to add the ability
to create rados namespace for a given
ceph block pool. Typically the name of the pool
is the name of the blockpool created by rook.
Closes: #7035
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
For supporting features like service account authentication for vault
KMS , a service account account need to attach with pod.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
The purge job is intended to clean up all the resources
related to an OSD that is to be removed. An OSD with
a metadata, wal, and data PVC was only cleaning up the
data PVC. Now the metadata and wal PVCs will also be
cleaned up.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
updating the csi-snapshotter and dependencies
to v5.0.1 released version.
Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit restrict csiaddons to open only 1 port
as per the requirement which is required for security.
Fixes: #9604
Signed-off-by: yati1998 <ypadia@redhat.com>
Rook needs to be able to watch all `ceph.rook.io` resources to reconcile
them; however, it does not need blanket verb privileges. Reduce the
privileges as much as possible.
Ideally, Rook would only have update permissions to status and
finalizers of resources; however, finalizers are not a full-fledged
subresource at this time, and "update" permissions must be maintained
for `ceph.rook.io` resources.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job
creating pods under PSP-enabled Kubernetes cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
Generate deploy/examples/common.yaml from Helm charts. There were still
a few differences between common.yaml and the Helm charts. Where there
were differences we assume common.yaml was the most up-to-date.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
In anticipation of generating common.yaml from the Helm charts, sort
common.yaml using the same script used to sort the output from Helm
charts.
This was done using the flow here:
```
cat build/rbac/common.yaml.header > new-common.yaml
cat deploy/examples/common.yaml | build/rbac/keep-rbac-yaml.sh >> new-common.yaml
mv new-common.yaml deploy/examples/common.yaml
```
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
In order to generate common.yaml from Helm charts, we have to have a
different way of generating CSV than from meta-comments in common.yaml.
This implementation changes what appears in the CSV's RBAC somewhat, but
these changes could be considered bugs fixed by using the new Helm
generation method.
- a few PSP related resources are removed from CSV
- resources related to 'rook-ceph-purge-osd' Job are added to CSV
- ClusterRoleBinding 'rook-ceph-object-bucket' is added to CSV
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Blaine Gardner
Mudit Agarwal
yati1998
parth-gr
Rakshith R
Madhu Rajanna
Travis Nielsen
Humble Chirammal
Yuichiro Ueno
subhamkrai
Jiffin Tony Thottan
Daniel Ruiz Capilla
Sébastien Han