This commit adds util function to create key rotation cron job
such as getKeyRotationContainer, getKeyRotationCronPodTemplateSpec
and makeKeyRotationCronJob.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit ef38aea2a4)
This commit adds functionality to be able to rotate
key encryption key of encrypted PVC backed OSDs.
Necessary changes such as adding update functionality
to kms and rbac changes are made as well.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 71e011f731)
This commit adds support for updating secret for default KMS.
This is required for encryption key rotation.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit b41fdfbb62)
This commit adds util functions to support encryption key rotation
such as RemoveEncryptionKeySlot, AddEncryptionKey and
ensureEncryptionKey.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 973723cbdd)
This commit adds KeyRotationSpec to cephcluster CR
to support encryption key rotation feature.
If enabled Rook will create a cronjob for each
encrypted PVC based OSD with given schedule set
to rotate their respective key encryption key.
Signed-off-by: Rakshith R <rar@redhat.com>
(cherry picked from commit 46dd2eb5ff)
The exporter requires the mon config and keyring.
Use the CEPH_ARGS env var to specify the config
instead of expecting a ceph.conf to be generated
by another component on the host path.
Co-Authored-By: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
(cherry picked from commit b6013d9b11)
When the alerts were updated from the ceph repo, the cephadm
alerts were removed, now we also remove two other alerts that
don't apply to rook clusters. The pool growth warning alert
and prometheus job missing alerts need to be removed
as also seen in https://github.com/rook/rook/pull/10109.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit fd25eeecf1)
It seems that this `deviceFilter` list item is indented too far.
This PR deindents it one level.
Signed-off-by: AJ Schmidt <ajs4392@gmail.com>
(cherry picked from commit da0ed4d21f)
Rook's implementation of OBC's GenerateUserID could generate colliding
user IDs for multisite clusters where each site is configured with the
same namespace/name of CephObjectStore. Add the Ceph cluster FSID to the
generated name to ensure the names won't conflict for multiple sites.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
(cherry picked from commit 2733375ca4)
if a cluster won't use the deafult realm and try to
execute the python script it will fail to vaildate rgw
as the rgw-admin-user would be created on default realm
So creating user in specific realm if the realm name is passed
Signed-off-by: parth-gr <paarora@redhat.com>
(cherry picked from commit 96ea7817f8)
Add container ports for OSD container only when multi cluster service is
enabled in the cluster spec.
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit 12bbc9b1a8)
ceph crash pod gets rook version label added unintentionally, which is only for deployment label.
changes include:
1, make a copy of the labels for pod spec from deployment labels just before adding rook version label.
2, add unit test to make sure it works as designed.
This fix along with pr 11674 is to stop ceph daemons pod restarting unnecessarily after upgrading rook operator.
Signed-off-by: Ben Gao <bengao168@msn.com>
(cherry picked from commit ed6ed25257)
The snyk check is failing because the -buildvcs flag
is defaulting to true. Let's disable this flag to
get the check passing.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 9197966ed4)
'kubectl apply --server-side' still doesn't always update CRDs
correctly if a CRD is too big to have its last applied annotation. Use
'kubectl replace' instead.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
(cherry picked from commit 38f896ea30)
If a kernel device name change happens and a block device file
in the OSD directory becomes dangling link, this OSD fails
to start continuously. This problem can be resolved by confirming
the validity of the device file and recreating it if necessary.
The original problem happened in host-based clusters. A similar
problem exists in PVC-based clusters. In this case, if a PV,
corresponds to an existing OSD, and points to a missing block
device file, the OSD pod fails to consume this PV. Although this
behavior is undesirable, I don't think this problem should be
handled in Rook. If doing so, we must re-create the existing PV.
Rook shouldn't do such work.
Closes: https://github.com/rook/rook/issues/10860
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
(cherry picked from commit 3a44a394b5)
Rakshith R
Travis Nielsen
avanthakkar
Redouane Kachach
mergify[bot]
gauravsitlani
AJ Schmidt
subhamkrai
Blaine Gardner
parth-gr
zhucan
Alexander Trost
sp98
Ben Gao
Satoru Takeuchi