Michael Adam
beb7163af2
Signed-off-by: Michael Adam <obnox@samba.org>
this change introduces a new 'make target 'docs'that generates part of the documentation
It particular, it runs the `helm-docs` target.
Additionally, `make docs` updates the multus validation job manifest
by inserting the output of `rook multus validation run --help` between
two newly introduced markers.
The result of running `make docs` is intended to be committed to git after running
Fixes: #12706
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Co-authored-by: Michael Adam <obnox@samba.org>
Update build/deploy/generate-deploy-examples.sh
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 22882c5358)
164 lines
7.1 KiB
YAML
164 lines
7.1 KiB
YAML
####################################################################################################
|
|
# This manifest contains a Kubernetes Job and supporting definitions for running Rook's Multus
|
|
# validation tool. The Multus validation tool's help text is copied below. Modify the Job
|
|
# definition in this manifest based on the needs of your cluster.
|
|
####################################################################################################
|
|
# THE BELOW HELP TEXT IS AUTO-GENERATED BY `make docs`
|
|
#
|
|
# Run a validation test that determines whether the current Multus and system
|
|
# configurations will support Rook with Multus.
|
|
#
|
|
# This should be run BEFORE Rook is installed.
|
|
#
|
|
#
|
|
#
|
|
#
|
|
#
|
|
#Flags:
|
|
# --cluster-network string The name of the Network Attachment Definition (NAD) that will be used for Ceph's cluster network. This should be a namespaced name in the form <namespace>/<name> if the NAD is defined in a different namespace from the cluster namespace.
|
|
# -c, --config string The validation test config file to use. This cannot be used with other flags.
|
|
# --daemons-per-node int The number of validation test daemons to run per node. It is recommended to set this to the maximum number of Ceph daemons that can run on any node in the worst case of node failure(s). The default value is set to the worst-case value for a Rook Ceph cluster with 3 portable OSDs, 3 portable monitors, and where all optional child resources have been created with 1 daemon such that they all might run on a single node in a failure scenario. If you aren't sure what to choose for this value, add 1 for each additional OSD beyond 3. (default 16)
|
|
# -h, --help help for run
|
|
# -n, --namespace string The namespace for validation test resources. It is recommended to set this to the namespace in which Rook's Ceph cluster will be installed. (default "rook-ceph")
|
|
# --nginx-image string The Nginx image used for the validation server and clients. (default "nginxinc/nginx-unprivileged:stable-alpine")
|
|
# --public-network string The name of the Network Attachment Definition (NAD) that will be used for Ceph's public network. This should be a namespaced name in the form <namespace>/<name> if the NAD is defined in a different namespace from the cluster namespace.
|
|
# --timeout-minutes timeoutMinutes The time to wait for resources to change to the expected state. For example, for the test web server to start, for test clients to become ready, or for test resources to be deleted. At longest, this may need to reflect the time it takes for client pods to to pull images, get address assignments, and then for each client to determine that its network connection is stable. Minimum: 1 minute. Recommended: 2 minutes or more. (default 3m0s)
|
|
#
|
|
#Global Flags:
|
|
# --log-level string logging level for logging/tracing output (valid values: ERROR,WARNING,INFO,DEBUG) (default "INFO")
|
|
#
|
|
# THE ABOVE HELP TEXT IS AUTO-GENERATED BY `make docs`
|
|
####################################################################################################
|
|
---
|
|
# Service account for job that validates multus configuration
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
---
|
|
# Aspects of multus validation job that require access to the operator/cluster namespace
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps", "configmaps/finalizers", "pods"]
|
|
verbs: ["get", "list", "create", "update", "delete"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["daemonsets"]
|
|
verbs: ["list", "create", "delete", "deletecollection"]
|
|
- apiGroups: ["k8s.cni.cncf.io"]
|
|
resources: ["network-attachment-definitions"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs"]
|
|
verbs: ["get", "list", "delete"]
|
|
---
|
|
# Allow the multus validation job to run in this namespace
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-multus-validation
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
# A job that runs the multus validation tool
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
labels:
|
|
app: rook-ceph-multus-validation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: rook-ceph-multus-validation
|
|
spec:
|
|
serviceAccountName: rook-ceph-multus-validation
|
|
containers:
|
|
- name: multus-validation
|
|
image: rook/ceph:master
|
|
command: ["rook"]
|
|
args:
|
|
- "multus"
|
|
- "validation"
|
|
- "run"
|
|
# - "--public-network=<NAD-NAME>" # uncomment and replace NAD name if using public network
|
|
# - "--cluster-network=<NAD-NAME>" # uncomment and replace NAD name if using cluster network
|
|
# - "--nginx-image=<IMAGE>" # uncomment and replace IMAGE with the nginx image you want use for the validation server and clients
|
|
# - "--daemons-per-node=<COUNT>" # uncomment and replace COUNT with the maximum number of daemons that should be running on each node during validation
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: ROOK_LOG_LEVEL
|
|
value: DEBUG
|
|
restartPolicy: Never
|
|
---
|
|
# This Pod Security Policy (PSP) allows the job to run in Kubernetes environments using PSPs
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: RoleBinding
|
|
# metadata:
|
|
# name: rook-ceph-multus-validation-psp
|
|
# namespace: rook-ceph # namespace:cluster
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: ClusterRole
|
|
# name: psp:rook
|
|
# subjects:
|
|
# - kind: ServiceAccount
|
|
# name: rook-ceph-multus-validation
|
|
# namespace: rook-ceph # namespace:cluster
|
|
# ---
|
|
# SecurityContextConstraints(SCC) for the Rook and Ceph daemons
|
|
# kind: SecurityContextConstraints
|
|
# apiVersion: security.openshift.io/v1
|
|
# metadata:
|
|
# name: rook-ceph-multus-validation
|
|
# allowPrivilegedContainer: true
|
|
# allowHostDirVolumePlugin: true
|
|
# allowHostPID: false
|
|
# # set to true if running rook with host networking enabled
|
|
# allowHostNetwork: true
|
|
# # set to true if running rook with the provider as host
|
|
# allowHostPorts: true
|
|
# priority:
|
|
# allowedCapabilities: ["MKNOD"]
|
|
# allowHostIPC: true
|
|
# readOnlyRootFilesystem: false
|
|
# # drop all default privileges
|
|
# requiredDropCapabilities: ["All"]
|
|
# defaultAddCapabilities: []
|
|
# runAsUser:
|
|
# type: RunAsAny
|
|
# seLinuxContext:
|
|
# type: RunAsAny
|
|
# fsGroup:
|
|
# type: RunAsAny
|
|
# supplementalGroups:
|
|
# type: RunAsAny
|
|
# seccompProfiles:
|
|
# - "*"
|
|
# volumes:
|
|
# - configMap
|
|
# - emptyDir
|
|
# - projected
|
|
# users:
|
|
# - system:serviceaccount:rook-ceph:rook-ceph-multus-validation # serviceaccount:namespace:cluster
|
|
---
|