The minio operator has not had community support nor
any updates since being added to Rook. Support is being
removed from Rook due to this lack of community interest.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
With the release of K8s 1.17 Rook needs to test on this new version.
The integration tests will now run the tests across K8s 1.13-1.17.
The pattern has been to run the tests across the most recent five
versions.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The retry messages are too verbose with the stack trace
since the aggregated messages were added. This change
turns off the verbose message.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
A new CRD option `continueUpgradeAfterChecksEvenIfNotHealthy` is added.
When upgrading, Rook goes OSD by OSD and then waits for PGs to be clean
before proceeding to the next OSD. Currently, Rook waits for 5 hours but
there might be circumstances where PGs need more time to settle.
Thus setting `continueUpgradeAfterChecksEvenIfNotHealthy` to true will
pursue the upgrade process, even if PGs are not 100% active+clean.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1786029
Signed-off-by: Sébastien Han <seb@redhat.com>
Add support for the k8s 1.17 official zone/region failure domain labels.
Our earlier guess that the official labels would be
<failure-domain.kubernetes.io> was wrong; the official is now
<topology.kubernetes.io>.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
The operator kit had more utility originally when the operator
was creating and managing the TPRs and CRDs directly. Since
the CRDs are now created from a manifest and no longer by the
operators, the utility of operator kit is limited to the
controller watcher. Since we are moving to the controller runtime
we simplify the code to make the transition smoother. Now
there is only a simple WatchCR method that will need to be
replaced as we maek that transition.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Replaced `math/rand` with more secure `crypto/rand` which will generate CSPRNG.
Changed the length of dashboard password from 10 to 20 and included more special characters that can strengthen password.
Passwords before this change: QoMmqLkaOf,8tqTyWF1sZ
Passwords after this change: L{QZ@_c'Rl7$uvW:UHU1, fP-OjX`UVw0J0Ka/scS(
Resolves: https://github.com/rook/rook/issues/4571
Signed-off-by: Nizamudeen <nia@redhat.com>
After a failure in a live ceph cluster, I discovered some minor glitches
when executing the instructions in ceph-disaster-recovry.md. Hopefully
this should help others.
Signed-off-by: Rik Harris <git@kawaja.net>
Fix security issues identified by TrailOfBits:
Logging of sensitive information in debug mode
Problematic debug lines which can contain sensitive data have been removed
Resolves: #4568
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
If obj is not successfully cast into an e dgefsv1.Cluster, ok will be false, resulting in the .Update(cluster) operation not running, and the declared err variable retaining its default nil value. Subsequently, a check against err is performed, which will evaluate to false, resulting in logging the finalizer as removed when it in fact was not.
Signed-off-by: Nizamudeen <nia@redhat.com>
security issues identified by TrailOfBits:
Improperly handled type assertion error could result in invalid
execution state.
If we obtain an error trying to get a Node object is better not
continue executing this function.
Resolves#4567
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
"ceph-volume activate" on encrypted osds needs a ceph.conf as well as
connectivity to the mons. This commit adds that to that "activate-osd"
init container.
Closes: https://github.com/rook/rook/issues/4558
Signed-off-by: Sébastien Han <seb@redhat.com>
* bumping ceph-operator memory limit from 128Mi to 256Mi in order to
avoid OOMkills of the rook-ceph-operator pod
* updating documentation example for operator to denote a limit of 256Mi
instead of 128Mi
When upgrading from rook v1.1.7 to v1.2.0, the rook-ceph-operator pod
continued to get OOMKilled by the kubernetes scheduler. Manually
bumping this limit to something higher than 128Mi (I tried 256Mi and it
was good) prevented the OOMKills.
Signed-off-by: Jeff Billimek <jeff@billimek.com>
The OSDs on PVCs were changing location in the CRUSH
hierarchy after an operator restart due to the location
property not being re-discovered on the OSD daemon.
Since OSDs on PVCs do not run the prepare pod again
to discover this property, the operator must read it
off the existing osd deployment. The operator was
reading other properties, but now will read the location
as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
To simplify the readability of the important sections for the upgrade
we will increase the header size.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Add the `ceph-` prefix to the `disaster-recovery.md` document since it
is Ceph-specific and should be logically grouped with the rest of the
`ceph-` docs.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Added table of contents to the Ceph advanced configuration page to make
it easier to find the right section till the theme / layout of the
homepage can autogenerate a toc if enabled.
Signed-off-by: Alexander Trost <galexrt@googlemail.com>
The isUpgrade flag was being set every time the operator
was started. This caused the upgrade checks to be run every
time the operator restarted. Thus, if any mons were down,
you likely would get stuck on the upgrade checks since another
mon could not be stopped. We need to rely on the upgrade being
detected either by a different image name from the cluster CR
update, or from different versions of the daemons running
in case the operator was restarted in the middle of an upgrade.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
Sébastien Han
Dmitry Yusupov
Blaine Gardner
Nizamudeen
Alexander Trost
Rik Harris
Juan Miguel Olmo Martínez
Jeff Billimek