This commit updates the CephNFS CR to make the RADOS settings optional
for Ceph versions above 16.2.7 due to the NFS module changes in Ceph.
The changes in Ceph make it so the RADOS pool is always ".nfs" and the
RADOS namespace is always the name of the NFS cluster.
This commit also handles the changes in Ceph Pacific versions before 16.2.7
where the default pool name is "nfs-ganesha" instead of ".nfs".
Closes: https://github.com/rook/rook/issues/8450
Signed-off-by: Joseph Sawaya <jsawaya@redhat.com>
As 'CephMonHighNumberOfLeaderChanges' means there is a
multiple monitor election and indicate some communication
issue between the monitors. Increasing interval timing for
this alert is not considered as safe. So reverting this
change back to 5m
Signed-off-by: Arun Kumar Mohan <amohan@redhat.com>
The following alerts,
CephMonHighNumberOfLeaderChanges
CephOSDDiskNotResponding
CephClusterWarningState
, which are resolved automatically, in most cases,
are causing unnecessary admin events. So we are increasing the
alert delay time to '15m'.
Signed-off-by: Arun Kumar Mohan <amohan@redhat.com>
Instead of using 'absent' query, we are trying to use 'up' which should
provide us with the needed 'namespace' field in the resultant metrics
Signed-off-by: aruniiird <amohan@redhat.com>
While build.all we have race condition where images.txt
file was update with duplicate entries. So, removing `-a`
from 1st tee and also add `sort -h`and `uniq` command to
confirm no duplicate entry is in the file.
Signed-off-by: subhamkrai <srai@redhat.com>
If we call the script with --monitoring-endpoint
10.1.8.29,10.1.8.36,10.1.8.25, we need to parse each comma-separated
address and not the entire block.
Now each address is tested properly.
Signed-off-by: Sébastien Han <seb@redhat.com>
The purge osd job need to read and update persistentvolumeclaims
While the job doesn't failed with osd and deployments well deleted
The associated pvc is not deleted by the job as it failed to read it
Signed-off-by: n.fraison <n.fraison@criteo.com>
We don't need to use tini.
We don't have anything in the rook operator that would
either create zombie processes (no threads) or use
exec (to fork). The Go binary has a really good
signal handling mechanism.
Closes: https://github.com/rook/rook/issues/8794
Signed-off-by: Sébastien Han <seb@redhat.com>
Reduce the RBAC scope for the lib-bucket-provisioner to the minimum
necessary for Rook to operate with lib-bucket-provisioner. Comment the
RBAC so that users can make informed decisions about whether or not they
can remove the permissions for their uses.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
In Rook v1.8 the min version of K8s supported is updated to 1.16.
Users running on older versions of K8s are recommended to update
to 1.16 or newer before updating to Rook v1.8.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The flex driver has been fully deprecated and thus removed from Rook.
Before upgrading to v1.8, users will need to convert existing flex volumes
from flex to csi volumes.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Due to the latest jsonnet and jsonnetfmt, v0.17.0, we have the
`description` and `message` lines format changed.
Signed-off-by: Arun Kumar Mohan <amohan@redhat.com>
added new option to set the provisioner replicas.
with this new option the user/admin can choose
how many replicas he want for provisioner pod if
number of nodes is greater than 1.
fixes#8153
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Rook now exports both ceph and csi SCCs to run on openshift so any
program pulling rook can inject the right SCCs.
In the meantime, default SCC has been reinforced to be less permissive.
Documentation has been reworked and a new path for openshift
installations has been created. Rook still provides the YAML files for
manual installations.
Closes: #8713
Signed-off-by: Sébastien Han <seb@redhat.com>
Let's force v16.2.5 since the CI is broken with 16.2.6. This gives us
time to continue to merge work and work on fixing deployments with
16.2.6 in parallel.
Signed-off-by: Sébastien Han <seb@redhat.com>
Remove unused ability to modify CRDs from Rook cluster roles. Rook (as
an operator) should not have the ability to modify CRDs used by the
components it controls.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
it has happened more than once that the manifests do not
reflect the images so now reading from `pkg/operator/ceph/csi/spec.go`
as this what code uses.
Closes: https://github.com/rook/rook/issues/8687
Signed-off-by: subhamkrai <srai@redhat.com>
The updated query will work for single mon deployment and will work better for
deployments with five or more mons.
Signed-off-by: Anmol Sachan <anmol13694@gmail.com>
Typical clusters only require 3 or maybe 5 mons. If someone really wants
to go crazy they can add more mons, but over 9 mons really should not be
used.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
While an even number of mons can cause lower availability of
mon quorum, it also can provide higher durability for the cluster.
Mon quorum can be restored from a single mon according to the
disaster recovery guide, so there may be scenarios where
an even number of mons may be preferable.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
When setting a default values with kubebuilder flags it seems that the
kube operator intercepts the API call, mutate the CR and inject it.
This results in two events, one for creation and one for edition and we
end up with 2 reconciles. Let's avoid this.
Signed-off-by: Sébastien Han <seb@redhat.com>
Our admission webhooks will now run as part of the Operator container
and not an additional deployment. This has the advantage of consuming
fewer resources in the cluster and not having to manage affinities and
tolerations. This only drawback is that the Secret containing the
certificates is not mounted anymore and the content needs to be written
inside the Operator. This is not practical since we also need to watch
for the Secret content to change. Meaning that the certificates have
been renewed and the webhook server needs to use them.
A new approach is on its way to hopefully simplify this last issue and
implement a watcher for the Secret.
In the meantime, users need to use the cert-manager or renew
certificates manually. Additionally, they must update the
ValidatingWebhookConfiguration object with the new CA bundle.
Signed-off-by: Sébastien Han <seb@redhat.com>
Thanks to Golang 1.16, we can now embed files in the Go binary. This
means we don't need to add the CSI templates files to the container
image. They are added in the Go binary at build time.
The existing location of the template must be in the package calling it.
So they moved to pkg/operator/ceph/csi/template. All the files have been
symlinked back to cluster/examples/kubernetes/ceph/csi/template.
Closes: https://github.com/rook/rook/issues/7609
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit adds permissions to the rook-ceph-mgr role
to delete PVCs and deployments and patch deployment scale
to remove OSDs using `ceph orch osd rm` in the rook orchestrator.
Signed-off-by: Joseph Sawaya <jsawaya@redhat.com>
Joseph Sawaya
Arun Kumar Mohan
Sébastien Han
Blaine Gardner
subhamkrai
Satoru Takeuchi
n.fraison
Blaine Gardner
Humble Chirammal
parth-gr
Travis Nielsen
Madhu Rajanna
chengli
Jiffin Tony Thottan
Anmol Sachan
injninja