Adding seccomp annotations to the PSP has made Kubernetes start choosing
the recommended Kubernetes "default" PSP over the Rook privileged PSP,
causing operator start errors. Append 00 (double zero) to the beginning
of the PSP name to make sure it is one of the first PSPs checked by
Kubernetes and will be matched before the "default" one.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Currently, helm chart is little outdated and has differences with
example/common.yaml.
This commit modifies both manifests to use same resources.
Signed-off-by: binoue <banji-inoue@cybozu.co.jp>
The name of a CephCluster is commonly the same as the namespace,
but not always. When looking up the ceph cluster we can look for
the first one in the namespace rather than requiring the name
to be the same as the namespace.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Currently, we need to configure the Ceph external Admin keyi
in the Rook deployment to be able to connect to an external Ceph cluster.
If we wanted to run in a multi-tenant fashion
were several K8s/Rook clusters wanted to connect to the same external ceph cluster,
each K8s deployment would have the access to the External Ceph Admin key
and could potentially access or delete the Data
from pools that belong to other k8s/Rook Clusters.
Now the admin key is optional but the helper script create-external-cluster-resources.sh
will help create the necessary keys/users to connect to that cluster.
Closes: https://github.com/rook/rook/issues/4917 and https://github.com/rook/rook/pull/5227
Signed-off-by: Sébastien Han <seb@redhat.com>
The integration test certainly fails with linux kernel v4.4.x, the default
kernel of Ubuntu 16.04. It succeeds with the linux kernel v4.8.x that can be
got by apt-get. Let's declare this as the desired version.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
The device name for OSD is fixed to /dev/xvdc. It works fine in the CI.
However, the name would be different in the developer's local environment.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Refactor the StartTestCluster method to make it more readable.
I have put most of the parameters used in this function in the struct.
In this way the call to this function is more easy to understand and to use.
The addition of new parameters to this method started to be annoying.
[test ceph]
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
kubeadm installer tries to install the fixed versions of some packages.
So if the newer versions are already installed, this script fails.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
After running `swapoff -a`, systemd re-enable swap soon.
We should stop the corresponding unit to avoid this problem.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
This commit adds seccomp annotations to the PSP shipped with Rook
Operator. In this way the operator when deployed will be more secure and
will only be allowed the syscalls defined the runtime's seccomp profile.
Signed-off-by: Suraj Deshmukh <surajd.service@gmail.com>
Previously, the rbd-mirror daemon was integrated into the `CephCluster`
CRD. This wasn't really practical since we would have to wait for the
whole orchestration to be done to actually set it up. The same goes for
any CR update. Let's say you want to change the number of daemons, Rook
would go through mons, mgrs and osds until it get to rbd-mirror.
This triggers an undesired full orchestration.
With its own CRD this component just gains a lot more flexibility.
Closes: https://github.com/rook/rook/issues/5084
Signed-off-by: Sébastien Han <seb@redhat.com>
The command line flags parsing inside an init() method was causing
issues at runtime when trying to add certain new features, which
is a limitation of the flag parsing. We now move away from using
any command line flags in the tests and only use environment variables
to simplify adding new parameters to the tests.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Ceph integration test tries to wipe all lvms including
the ones that are not related to this test.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
- `helm_read` is not a command, but a variable
- If `helm` was installed in `helm.sh up`, the following `heml.sh clean`
fails since `helm_rest` can't find the installed `helm`.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
On Octopus, the "ceph fs status" reports on stderr for some reason.
So we need to combined the output to read the filesystem status.
Signed-off-by: Sébastien Han <seb@redhat.com>
The upgrade test will now support upgrading from nautilus
to octopus and that files and be read and written
after the upgrade.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The upgrade test requires the CSI driver to be running so we cannot
run the test on older versions than k8s 1.13.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit f90664209b)
Update cephcsi driver to v2.0.1 to allow nodes with
Ceph persistent volumes to shutdown cleanly. This requires
an additional bind mount (/run/mount) in cephfsplugin
and rbdplugin templates.
Signed-off-by: Chu Yong Mark Lee <markleechuyong@gmail.com>
You can now use Rook along with Multus. Multus must be up and running
and the right ressources must exist such as NetworkAttachmentDefinition
CR.
The Cluster CR spec has new fields to work with multus:
network:
provider: multus (or 'host' for hostNetworking)
selectors:
public: NetworkAttachmentDefinition name
cluster: NetworkAttachmentDefinition name
If only a single NetworkAttachmentDefinition is provided Rook will use
both anyway for the Ceph traffic.
Please refer to the doc to learn more.
Closes: https://github.com/rook/rook/issues/4716
Signed-off-by: Sébastien Han <seb@redhat.com>
Some versions of k8s can optionally enable extensions after deprecation.
This could lead to rbac denials when trying to perform operations on deployments
Signed-off-by: Rohan CJ <rohantmp@gmail.com>
The CephManifests interface is intended for manifests that install the product (RBAC, CRDs, operator, etc). These cleanup methods are more about test code. The test code needs to behave the same whether it is a normal install or an upgrade. We don't need to version it differently for upgrades between the CephManifestsMaster and CephManifestsV1_1 implementations
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
In case of multiple clusters, we don't want to delete all the mon directories under the dataDirHostPath during cluster cleanup.
This PR deletes the mon directory only if the montior secret key matches.
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
Various updates are needed for the v1.3 release.
- The pending release notes were missing some features
- Added a section to the upgrade guide for breaking changes to OSDs
- Clarifications around Ceph prereqs and min version
- Other misc clarifications
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With 1.18 in the test matrix we need to update which versions
will run the different ceph test suites.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With the release of Octopus we need to run the integration tests
on Octopus in order to have validation as a supported platform.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In order to ensure proper clean up of all the rook-ceph data when the cluster is deleted, we need to clean up the dataDirHostPath (var/lib/rook)
Signed-off-by: Santosh Pillai <sapillai@redhat.com>
In order to perform full automation of cephcluster deletion safely
and protect against catastrophic data loss, the end user must be
able to signify that they intend to irrecoverably delete the data
in their cluster. The cleanupPolicy field of the cluster spec is
intended to communicate this. This patch does not implement
automated deletion, but only creates the spec field and the
safety feature of halting orchestration other than deletion on a
cluster with a set cleanup policy value.
Partially-fixes: #3222
Signed-off-by: Elise Gafford <egafford@redhat.com>
The integration tests are failing to run when the disks
are not properly cleaned up and the bluestore label
is still found. Now we run sgdisk to more completely
zap the disk.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Run the tests on latest nautilus with the tag ceph/ceph:v14 so we
are constantly testing on the latest release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This fix is added to ensure that everything works as expected
when user tries to create ObjectStoreUser before creating
ObjectStore itself. ObjectStoreUser will wait for ObjectStore
to be up and running.
Signed-off-by: Umanga Chapagain <chapagainumanga@gmail.com>
This commit fixes the argument for "ceph-volume inventory".
When a device "/dev/mapper/foo" is being checked for its availability,
the argument should not be "/dev/foo" nor "/dev/dm-1".
Signed-off-by: morimoto-cybozu <kenji_morimoto@cybozu.co.jp>
This commit adds all the CSI configurations to ConfigMap.
This configMap can be used in combination with Env Vars
to configure Ceph CSI drivers in rook.
Signed-off-by: Umanga Chapagain <chapagainumanga@gmail.com>
Blaine Gardner
binoue
Travis Nielsen
Sébastien Han
Satoru Takeuchi
Satoru Takeuchi
Juan Miguel Olmo Martínez
zoetrope
Suraj Deshmukh
Chu Yong Mark Lee
Rohan CJ
Santosh Pillai
ShyamsundarR
Elise Gafford
Umanga Chapagain
morimoto-cybozu