Added failureDomains and osdsPerDomain fields to the
ErasureCodedSpec, which maps to the crush-num-failure-domains and
crush-osds-per-failure-domain Ceph EC profile parameters. This enables
creating EC pools that distribute chunks across fewer, larger hosts
without needing one host per data chunk.
Signed-off-by: Prabhala Tara Aasrita <taraprabhala@Prabhalas-MacBook-Pro.local>
(cherry picked from commit 715f38de91)
Publishing docs runs mike deploy against the rook.github.io gh-pages
branch. When two builds run close together, the branch can advance
between one build's fetch and its push, and the push is rejected as
non-fast-forward, failing the whole push-image-to-container-registry
job even though the images were already published (most recently on the
2026-07-06 master push burst). Reset the local gh-pages branch to the
remote tip and retry the deploy up to three times, so a lost race
redeploys onto the new tip instead of failing the build.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8b2bedfa9a)
The operator image in the rook-ceph chart and the Ceph image in the
rook-ceph-cluster chart are both configured as a repository and tag
pair. The toolbox was the exception, taking a single toolbox.image
string.
Add toolbox.repository and toolbox.tag, so the toolbox image can be
configured the same way as the others. Either setting may be applied on
its own; whichever is left unset falls back to cephImage.repository or
cephImage.tag.
The new settings take precedence over toolbox.image, which continues to
apply when neither is set, so existing values files are unaffected.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit faf2bffe5a)
Document spec.server.port for host-network port conflicts, and describe
how user-managed LoadBalancer and NodePort Services must align port and
targetPort with the CR.
Signed-off-by: raaizik <raaizik@yahoo.com>
Co-Authored-By: Blaine Gardner <b.blaine.gardner@gmail.com>
(cherry picked from commit a400ae6fd5)
Add coverage for GetPort defaults and custom values, Service and probe
port wiring, Ganesha NFS_Port config, and create-or-update when
spec.server.port changes on an existing Service.
Signed-off-by: raaizik <raaizik@yahoo.com>
(cherry picked from commit b97296c47c)
When NFS runs with host networking, port 2049 may already be in use.
Add CephNFS spec.server.port (default 2049), wire it through Ganesha
config, the operator Service, and probes, and regenerate CRDs.
Signed-off-by: raaizik <raaizik@yahoo.com>
(cherry picked from commit 5e36fa4bc3)
When the active MGR IP already exists at a non-zero position in the
externalMgrEndpoints list, the rotation logic that replaces endpoints[0]
creates duplicate IPs. Also guards against mgr map failure which could
overwrite endpoints[0] with an empty string.
Fixes: #17761
Signed-off-by: beyondcloud-co <87993136+beyondcloud-co@users.noreply.github.com>
(cherry picked from commit 8134d683e3)
The go text package v0.37 has a vulnerability, thus update
to the latest version of the package.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 8c397f6381)
assignMons schedules each mon in its own goroutine and shares a
failedMonSchedule bool to record whether any of them failed. The
resultLock mutex already guards the shared c.mapping.Schedule map
write, but the three failedMonSchedule = true assignments were done
without holding the lock. When two or more mons fail to schedule at
the same time (for example when waitForMonitorScheduling errors, the
node choice is nil, or getNodeInfoFromNode fails) their goroutines
write the flag concurrently, which is a write-write data race.
Guard the failedMonSchedule writes with the existing resultLock, the
same lock the goroutines already use for the map update. The post-Wait
read is left as is since the WaitGroup orders it after every write.
Add a regression test that fails scheduling for multiple mons at once
and confirms assignMons returns an error; run it with -race to catch
the race.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit 0bbd5de84c)
decodePeerToken logged the whole decoded PeerToken with "%+v" at debug
level. PeerToken embeds Key, the peer cluster's cephx auth secret, so
running the operator with ROOK_LOG_LEVEL=DEBUG wrote that credential to
the operator logs in plaintext (CWE-532).
Log only the non-sensitive fields (fsid, client id, mon host, namespace),
which keep the message useful for diagnostics, and drop Key. Add a
regression test that captures the debug output and asserts the key is
never present.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit 1013a8effc)
The Placement field comments on RBDMirroringSpec and
FilesystemMirroringSpec both read "The affinity to place the rgw pods",
copied from GatewaySpec. Neither spec manages RGW pods: RBDMirroringSpec
configures the rbd mirror daemon and FilesystemMirroringSpec the
cephfs-mirror daemon.
Update the comments to name the correct pods, matching the wording
already used by the sibling Resources and PriorityClassName fields in
each struct, and regenerate Documentation/CRDs/specification.md so the
published CRD API reference matches.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
(cherry picked from commit b26cad41ef)
currently there was a bug in the code where it didnt removed
the account from the ceph cluster during intial intialize
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit cca7020f0b)
Expand the Node Loss section in block-storage.md to accurately describe the automatic fencing flow, and add dedicated Network Fencing sections across the CSI documentation to provide configuration examples for both manifest-based and Helm-based deployments.
* block-storage.md: introduce the Network Fencing prerequisite paragraph with links to the new example sections, replace the single-line "auto-fencing" description with three bullets describing the client blocklist flow, and update Node Recovery to a single sentence covering workload rescheduling and the 5-minute cool-down behavior that triggers automatic unblocklist. Add a Warning admonition instructing administrators not to remove the out-of-service taint before the node completes a full power cycle.
* csi-configuration.md: add a Network Fencing section enumerating the three prerequisites (CSI-Addons controller, CSI-Addons sidecar, enableFencing flag) and showing the RBD Driver CR manifest with deployCsiAddons and enableFencing set together.
* csi-drivers-chart.md: add a Network Fencing subsection under Custom settings showing the per-driver Helm values for deployCsiAddons and enableFencing, with a cross-reference to csi-configuration.md.
* ceph-csi-drivers.md: replace the legacy CSI_ENABLE_CSIADDONS configmap patch in the Enable CSI-Addons Sidecar section with the modern deployCsiAddons approach on OperatorConfig or Driver, and add a Network Fencing overview section that links out for configuration details and the operational flow.
Signed-off-by: N3rdBot <wujiafeng17@gmail.com>
(cherry picked from commit bc8d40095d)
Configure the CephHelmSuite object store as an RGW multisite zone so the
chart's CephObjectRealm, CephObjectZoneGroup, and CephObjectZone templates
are exercised on a Helm install. The operator must reconcile the realm,
zone group, zone, and store to Ready, which the existing install check
already gates on via the RGW pod count.
The realm/zone group/zone and shared-pool layout mirror the fixture in
tests/integration/object/util/sharedstore: a zone backed by explicit
CephBlockPools referenced through sharedPools.poolPlacements. The rgw pools
are appended to the block pools already configured for CSI, and are torn
down along with the multisite CRs when the default storage CRs are removed.
Gate the multisite configuration behind a new UseMultisiteObjectStore
setting enabled only for CephHelmSuite. The other Helm-based suites keep the
plain object store; the upgrade suite in particular installs an older base
chart that lacks the multisite templates and cannot resolve a zone-based
store.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8a72d80127)
# Conflicts:
# tests/integration/ceph_helm_test.go
Add optional CephObjectRealm, CephObjectZoneGroup, and CephObjectZone
resources to the rook-ceph-cluster chart so an RGW multisite topology can
be deployed from the chart alongside CephObjectStore.
Each resource type follows the existing per-list template idiom: a new
template ranges over a values list and renders name, namespace, and spec.
The realm template renders spec only when set, supporting both a new realm
(no spec) and a pulled realm (spec.pull.endpoint).
The three lists ship commented out in values.yaml with a multisite
example, matching the opt-in cephECBlockPools precedent, so a default
install creates no multisite resources.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 8989bff653)
Aggregate pool usage by pool before predict_linear to avoid duplicate series after mgr pod replacement, and add a one-hour hold time to match the source rule update in ceph/ceph#68621.
Signed-off-by: Jeff Wallace <jeff@tjwallace.ca>
(cherry picked from commit 5119f3aeb4)
CephFS reconciliation loop on Filesystem creation was swallowing errors.
The err variable which contained the error was replaced with the resulted error from the
kubernetes update status call on the CRD.
This commit fixes that and aggregate both errors in case there is both a kubernetes status update failure and a creation error.
Signed-off-by: Maxime Bertin <mbertin@luccasoftware.com>
(cherry picked from commit 0696b24d9c)
This change fixes some of the broken links in the markdown
documentatoion sources found by the markdown link checker.
Assisted-by: IBM Bob
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit a70d68b882)
currently, drbd hostname was ready using command
but now the change we use kubernetes built-in api
to read hostname from `spec.nodeName`.`
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit c49ef5f079)
Bump the most recent kubernetes version exercised by the integration and
canary matrices from v1.35.5 to v1.36.1. The kindest/node image for 1.36 is
provided by the kind v0.32.0 pinned by the kind-conversion commit. The older
matrix versions are unchanged.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit a280c3ae2d)
The minikube-to-kind conversion moved the master/release integration
tests to kind, which selects the Kubernetes version via the
kindest/node:<version> image tag. There is no published
kindest/node:v1.32.13 image (Docker Hub returns 404); the latest 1.32
node image kind ever built is v1.32.11, since later kind releases
advanced to 1.33+ and never produced a newer 1.32 patch.
Pin the on-release matrix's 1.32 entry to v1.32.11 so the 1.32-line
coverage keeps a node image that actually exists. The other matrix
versions (v1.31.14, v1.34.8, v1.36.1) already have published images.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 117e1126c2)
Updating csi-operator to latest v1.0.4 and
updating the required doc changes as well.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit a3e02e607d)
find_extra_block_dev piped find_extra_block_devs into head -1. Since
find_extra_block_devs prints every eligible disk and ends with echo
"$devs", head closes the pipe after the first line and the producer's
echo races into SIGPIPE (echo: write error: Broken pipe), failing the
command substitution under pipefail/errexit.
The race only fires reliably now that the runners present two data disks
(sdb and sdc), so find_extra_block_devs emits multiple lines; with a
single disk the one-line output almost never triggered it.
Read the producer to completion with mapfile via process substitution
and return the first element, mirroring find_second_block_dev, so there
is no downstream head to close the pipe early.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 7079c9bf62)
Prabhala Tara Aasrita
Travis Nielsen
mergify[bot]
Joshua Hoblitt
raaizik
beyondcloud-co
Michael Adam
Joshua Hoblitt
Anas Khan
parth-gr
N3rdBot
Jeff Wallace
Maxime Bertin
subhamkrai