In the whereabouts config, the network range is determined by range
option unlike other cni plugins that use Subnet option.
Signed-off-by: rohan47 <rohgupta@redhat.com>
We can now encrypted OSD device that were provisioned via a storage
class using the PV interface.
The encryption works at the storageClassDeviceSets level, which means we
can have encrypted and non-encrypted sets.
Using the new key `encrypted` we can turn it on.
Signed-off-by: Sébastien Han <seb@redhat.com>
The labels cannot be updated on a deployment match selector.
In v1.4 a new label was added for ceph_daemon_type that is intended
to be on the pod labels, but cannot be applied to the match selectors.
Therefore, we suppress any new labels that are added to the daemons.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
create csidriver object if the kubernetes version
is greater than 1.14 modified the check to allow
Csidriver object creation if kubernetes major version
is greater than 1.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
instead of skipping the checks based on the kubernetes
major version we need to check both major and minor
version of it.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
fixed the kubernetes version comparsion to
deploy provisioner as the statefulset.
if the kubernetes Major version is less than
1 or major is 1 and minor is less than 14
deploy provisioner as statefulset
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Currently this is no way to create user with system permission in objectstore.
Add support for the same
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
Currently if object store is missing user creation fails without throwing
any error. Here the access and secret key values will be checked post the
creation command
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Rename PodLabels function to CephDaemonAppLabels for more clarity about
what the function's purpose is.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
This can help users identify the daemon type similarly to how
'ceph_daemon_id' helps identify the daemon ID. This also makes it so
scripts users create don't have to parse "app=rook-ceph-<daemonType>"
into "<daemonType>" if they desire that bit of info.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
using defer for closing file which are open
for writing is not safe. so closing file again
following below steps:
1. open files
2. defer file.close()
3. write
4.file.close()
these will make sure files are closed.
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
File permissions need to be reduced to the minimum to avoid config
files from being accessed. While a connection to the pod would be
required to access the files, min privileges are set just as
another layer of security. This fixes gosec error G306.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit fixes where there are areas in which files and directories are
written and created with statically defined permissions. Many of these
permissions are rather open, potentially allowing other system tenants to
view and interact with their contents, which may be sensitive.
Fixed G303: Poor file permissions used for directory by using the most narrow permission
Resoves: https://github.com/rook/rook/issues/4580
Signed-off-by: Nizamudeen <nia@redhat.com>
The name generation utils need to provide consistent outputs across
versions so that names generated based on values are consistent and
older generated keys are not lost.
Signed-off-by: Rohan CJ <rohantmp@gmail.com>
Adding new apis such as EnableUserQuota() for enabling quota,
SetQuotaUserObjectMax() and SetQuotaUserMaxSize() for setting user specific quotas
for objects and size respectively. Please note the size is quota is determined in GBs.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
this commit handles all the gosec g601
error code (i.e Implicit memory aliasing
of items from a range statement).
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
this commit suppress the gosec errors for
g204: Audit use of command execution.
g304: File path provided as taint input.
g101: Look for hard coded credentials.
Signed-off-by: subhamkrai <subhamkumarrai03@gmail.com>
as we are going to deploy snapshotter by
default we are going to remove the kubernetes
version check.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
To ensure a file handle is closed, we defer the close command
so it is guaranteed to run when the method returns. The closing
of the file handle is not going to fail in our usage since we aren't
using the SetDeadline on the files that would cancel a request
and return an error.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
rohan47
Sébastien Han
Travis Nielsen
Madhu Rajanna
Satoru Takeuchi
Jiffin Tony Thottan
Jiffin Tony Thottan
Blaine Gardner
subhamkrai
Nizamudeen
Rohan Joseph