feat(deps): update rook-ceph-suite to v1.16.4 (minor) #1984
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Path: @@ -91,7 +91,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +108,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +125,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +153,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +170,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -239,10 +239,11 @@
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
@@ -269,7 +270,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +297,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +333,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +526,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +587,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +656,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +665,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +678,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +690,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +719,27 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +752,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,28 +772,22 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
@@ -825,6 +807,9 @@
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
@@ -835,7 +820,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -886,7 +871,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +892,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +936,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -998,7 +969,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1136,9 +1107,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1197,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1251,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,12 +1262,6 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1297,7 +1276,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1505,7 +1484,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1534,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1550,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.0"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,6 +1564,10 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false" |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -105,7 +105,7 @@
kind: StorageClass
metadata:
name: ceph-bucket
-provisioner: default.ceph.rook.io/bucket
+provisioner: rook-ceph.ceph.rook.io/bucket
reclaimPolicy: Delete
parameters:
objectStoreName: ceph-objectstore
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -319,7 +339,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -598,7 +618,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -719,7 +739,7 @@
prepareosd:
limits:
cpu: 500m
- memory: 200Mi
+ memory: 400Mi
requests:
cpu: 500m
memory: 50Mi |
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
6fa7536 to
06ea0da
Compare
|
Path: @@ -91,7 +91,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +108,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +125,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +153,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +170,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,19 +234,20 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
@@ -269,7 +270,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +297,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +333,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +526,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +587,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +656,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +665,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +678,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +690,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +719,27 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +752,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,47 +772,32 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
@@ -835,7 +808,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -886,7 +859,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +880,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +924,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -998,7 +957,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1136,9 +1095,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1185,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1239,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,12 +1250,6 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1297,7 +1264,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1505,7 +1472,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1522,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1538,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.1"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,6 +1552,10 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false" |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -319,7 +339,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -598,7 +618,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -719,7 +739,7 @@
prepareosd:
limits:
cpu: 500m
- memory: 200Mi
+ memory: 400Mi
requests:
cpu: 500m
memory: 50Mi |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
06ea0da to
fc5aca5
Compare
renovate
bot
changed the title
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -310,102 +330,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -598,7 +522,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -719,7 +643,7 @@
prepareosd:
limits:
cpu: 500m
- memory: 200Mi
+ memory: 400Mi
requests:
cpu: 500m
memory: 50Mi |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +88,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,20 +152,22 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
@@ -269,7 +189,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +216,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +252,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +445,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +506,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +575,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +584,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +597,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +609,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +638,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +674,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +694,38 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: 'psp:rook'
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +766,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +787,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +831,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -989,82 +855,6 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
----
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +926,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1016,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1070,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1081,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1207,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1257,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1273,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.2"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,6 +1287,10 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false" |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
fc5aca5 to
02eb9f5
Compare
renovate
bot
changed the title
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -310,102 +330,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -598,7 +522,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -717,9 +641,6 @@
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +88,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,20 +152,22 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
@@ -269,7 +189,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +216,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +252,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +445,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +506,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +575,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +584,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +597,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +609,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +638,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +674,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +694,38 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: 'psp:rook'
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +766,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +787,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +831,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -989,82 +855,6 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
----
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +926,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1016,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1070,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1081,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1207,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1257,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1273,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.3"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,6 +1287,10 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false" |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
02eb9f5 to
2d07e32
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +88,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,20 +152,22 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
@@ -269,7 +189,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +216,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +252,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +445,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +506,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +575,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +584,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +597,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +609,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +638,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +674,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +694,38 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: 'psp:rook'
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +766,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +787,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +831,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -989,82 +855,6 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
----
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +926,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1016,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1070,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1081,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1207,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1257,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1273,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.4"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,13 +1287,15 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- name: ROOK_ENABLE_DISCOVERY_DAEMON |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -310,102 +330,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -598,7 +522,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -637,6 +561,10 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
@@ -717,9 +645,6 @@
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
2d07e32 to
7202d13
Compare
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -310,102 +330,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -598,7 +522,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.3
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -637,6 +561,10 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
@@ -717,9 +645,6 @@
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +88,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,20 +152,22 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
@@ -269,7 +189,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +216,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +252,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +445,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +506,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +575,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +584,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +597,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +609,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +638,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +674,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +694,38 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: 'psp:rook'
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +766,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +787,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +831,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -989,82 +855,6 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
----
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +926,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1016,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1070,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1081,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1207,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1257,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1273,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.4"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,13 +1287,15 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- name: ROOK_ENABLE_DISCOVERY_DAEMON |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
7202d13 to
3f64e78
Compare
renovate
bot
changed the title
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -213,9 +213,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -310,102 +330,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -598,7 +522,7 @@
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v17.2.5
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -637,6 +561,10 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
@@ -717,9 +645,6 @@
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,7 +71,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -170,7 +88,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -234,20 +152,22 @@
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
CSI_ENABLE_CSIADDONS: "false"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
@@ -269,7 +189,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -296,7 +216,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +252,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -525,7 +445,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +506,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -655,6 +575,8 @@
- list
---
# Source: rook-ceph/templates/clusterrole.yaml
+# TODO: remove this, once https://github.com/rook/rook/issues/10141
+# is resolved.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
@@ -662,19 +584,7 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -687,10 +597,10 @@
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,30 +609,24 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
@@ -734,30 +638,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +674,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +694,38 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
- verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: 'psp:rook'
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +766,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +787,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,20 +831,6 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
-roleRef:
- kind: ClusterRole
- name: cephfs-csi-nodeplugin
- apiGroup: rbac.authorization.k8s.io
----
-# Source: rook-ceph/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
@@ -989,82 +855,6 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
----
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +926,29 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
- apiGroups:
- apps
resources:
@@ -1206,7 +1016,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1260,12 +1070,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1081,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1207,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1555,13 +1257,15 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
@@ -1569,7 +1273,7 @@
spec:
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "rook/ceph:v1.10.5"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
@@ -1583,13 +1287,15 @@
name: default-config-dir
- mountPath: /etc/webhook
name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- name: ROOK_ENABLE_DISCOVERY_DAEMON |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
3f64e78 to
2a9907c
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,56 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_DISABLE_HOLDER_PODS: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.12.2"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.0.1"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.0.1"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.6.1"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.11.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.9.1"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +234,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +247,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +276,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +312,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +323,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +342,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +371,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +391,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +460,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +515,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +576,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +652,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +676,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +698,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +742,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +778,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +798,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +896,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +917,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +961,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1001,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1028,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1040,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1074,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1166,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1197,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1213,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1228,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1239,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1276,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1349,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1395,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.15.5"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1470,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
738891d to
9e5f580
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,56 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_DISABLE_HOLDER_PODS: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.12.2"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.0.1"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.0.1"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.6.1"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.11.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.9.1"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +234,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +247,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +276,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +312,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +323,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +342,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +371,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +391,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +460,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +515,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +576,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +652,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +676,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +698,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +742,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +778,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +798,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +896,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +917,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +961,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1001,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1028,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1040,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1074,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1166,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1197,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1213,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1228,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1239,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1276,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1349,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1395,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.15.5"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1470,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v18.2.4
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
9e5f580 to
049d966
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,56 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_DISABLE_HOLDER_PODS: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.12.2"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.0.1"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.0.1"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.6.1"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.11.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.9.1"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +234,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +247,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +276,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +312,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +323,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +342,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +371,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +391,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +460,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +515,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +576,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +652,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +676,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +698,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +742,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +778,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +798,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +896,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +917,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +961,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1001,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1028,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1040,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1074,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1166,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1197,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1213,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1228,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1239,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1276,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1349,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1395,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.15.6"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1470,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v18.2.4
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
049d966 to
28a4bde
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,55 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.13.0"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.0.1"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.0.1"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.6.1"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.11.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.11.0"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +233,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +246,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +275,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +311,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +322,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +341,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +370,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +390,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +459,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +514,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +575,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +651,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +675,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +697,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +741,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +777,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +797,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update", "create"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +895,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +916,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +960,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1000,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1027,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1039,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1073,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1165,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1196,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1212,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1227,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1238,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1275,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1348,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1394,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.16.0"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1469,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v19.2.0
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
28a4bde to
a316615
Compare
renovate
bot
changed the title
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v19.2.0
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,55 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.13.0"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.0.1"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.2.0"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.6.1"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.11.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.11.0"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +233,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +246,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +275,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +311,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +322,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +341,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +370,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +390,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +459,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +514,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +575,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +651,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +675,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +697,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +741,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +777,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +797,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +895,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +916,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +960,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1000,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1027,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1039,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1073,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1165,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1196,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1212,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1227,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1238,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1275,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1348,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1394,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.16.1"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1469,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
a316615 to
bd4e851
Compare
renovate
bot
changed the title
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v19.2.0
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,55 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.13.0"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.1.0"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.2.0"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.8.0"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.13.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.11.0"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +233,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +246,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +275,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +311,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +322,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +341,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +370,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +390,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +459,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +514,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +575,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +651,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +675,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +697,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +741,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +777,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +797,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +895,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +916,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +960,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1000,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1027,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1039,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1073,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1165,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1196,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1212,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1227,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1238,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1275,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1348,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1394,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.16.2"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1469,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
bd4e851 to
f572273
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,55 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.13.0"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.1.0"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.2.0"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.8.0"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.13.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.11.0"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +233,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +246,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +275,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +311,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +322,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +341,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +370,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +390,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +459,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +514,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +575,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +651,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +675,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +697,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +741,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +777,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +797,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +895,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +916,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +960,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1000,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1027,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1039,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1073,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1165,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1196,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1212,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1227,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1238,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1275,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1348,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1394,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.16.3"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1469,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v19.2.0
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
Signed-off-by: Danny Froberg <[email protected]>
renovate
bot
force-pushed
the
renovate/rook-ceph-suite
branch
from
f572273 to
17633d3
Compare
renovate
bot
changed the title
|
Path: @@ -1,85 +1,3 @@
-# Source: rook-ceph/templates/psp.yaml
-# We expect most Kubernetes teams to follow the Kubernetes docs and have these PSPs.
-# * privileged (for kube-system namespace)
-# * restricted (for all logged in users)
-#
-# PSPs are applied based on the first match alphabetically. `rook-ceph-operator` comes after
-# `restricted` alphabetically, so we name this `00-rook-privileged`, so it stays somewhere
-# close to the top and so `rook-system` gets the intended PSP. This may need to be renamed in
-# environments with other `00`-prefixed PSPs.
-#
-# More on PSP ordering: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- name: 00-rook-privileged
- annotations:
- seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
- seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
-spec:
- privileged: true
- allowedCapabilities:
- # required by CSI
- - SYS_ADMIN
- - MKNOD
- fsGroup:
- rule: RunAsAny
- # runAsUser, supplementalGroups - Rook needs to run some pods as root
- # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
- runAsUser:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- # seLinux - seLinux context is unknown ahead of time; set if this is well-known
- seLinux:
- rule: RunAsAny
- volumes:
- # recommended minimum set
- - configMap
- - downwardAPI
- - emptyDir
- - persistentVolumeClaim
- - secret
- - projected
- # required for Rook
- - hostPath
- # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
- # allowedHostPaths:
- # - pathPrefix: "/run/udev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/dev" # for OSD prep
- # readOnly: false
- # - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
- # readOnly: false
- # Ceph requires host IPC for setting up encrypted devices
- hostIPC: true
- # Ceph OSDs need to share the same PID namespace
- hostPID: true
- # hostNetwork can be set to 'false' if host networking isn't used
- hostNetwork: true
- hostPorts:
- # Ceph messenger protocol v1
- - min: 6789
- max: 6790 # <- support old default port
- # Ceph messenger protocol v2
- - min: 3300
- max: 3300
- # Ceph RADOS ports for OSDs, MDSes
- - min: 6800
- max: 7300
- # # Ceph dashboard port HTTP (not recommended)
- # - min: 7000
- # max: 7000
- # Ceph dashboard port HTTPS
- - min: 8443
- max: 8443
- # Ceph mgr Prometheus Metrics
- - min: 9283
- max: 9283
- # port for CSIAddons
- - min: 9070
- max: 9070
----
# Source: rook-ceph/templates/cluster-rbac.yaml
# Service account for Ceph OSDs
apiVersion: v1
@@ -91,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -108,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -125,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -153,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/cluster-rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/serviceaccount.yaml
# Service account for the Rook-Ceph operator
apiVersion: v1
@@ -170,7 +102,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -220,6 +152,21 @@
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph/templates/serviceaccount.yaml
+# Service account for Ceph COSI driver
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: objectstorage-provisioner
+ namespace: default # namespace:operator
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph/templates/configmap.yaml
# Operator settings that can be updated without an operator restart
# Operator settings that require an operator restart are found in the operator env vars
@@ -227,38 +174,55 @@
apiVersion: v1
metadata:
name: rook-ceph-operator-config
+ namespace: default # namespace:operator
data:
ROOK_LOG_LEVEL: "INFO"
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: "15"
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: "true"
+ ROOK_CEPH_ALLOW_LOOP_DEVICES: "false"
+ ROOK_ENABLE_DISCOVERY_DAEMON: "false"
ROOK_CSI_ENABLE_RBD: "true"
ROOK_CSI_ENABLE_CEPHFS: "true"
+ ROOK_CSI_DISABLE_DRIVER: "false"
CSI_ENABLE_CEPHFS_SNAPSHOTTER: "true"
+ CSI_ENABLE_NFS_SNAPSHOTTER: "true"
CSI_ENABLE_RBD_SNAPSHOTTER: "true"
CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
CSI_ENABLE_ENCRYPTION: "false"
CSI_ENABLE_OMAP_GENERATOR: "false"
CSI_ENABLE_HOST_NETWORK: "true"
+ CSI_ENABLE_METADATA: "false"
+ CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: "true"
CSI_PLUGIN_PRIORITY_CLASSNAME: "system-node-critical"
CSI_PROVISIONER_PRIORITY_CLASSNAME: "system-cluster-critical"
- CSI_RBD_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_CEPHFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
- CSI_NFS_FSGROUPPOLICY: "ReadWriteOnceWithFSType"
+ CSI_RBD_FSGROUPPOLICY: "File"
+ CSI_CEPHFS_FSGROUPPOLICY: "File"
+ CSI_NFS_FSGROUPPOLICY: "File"
ROOK_CSI_KUBELET_DIR_PATH: "/var/lib/kubelet"
- ROOK_CSI_ENABLE_GRPC_METRICS: "false"
- CSI_ENABLE_VOLUME_REPLICATION: "false"
+ ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.13.0"
+ ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
+ ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.1.0"
+ ROOK_CSI_SNAPSHOTTER_IMAGE: "registry.k8s.io/sig-storage/csi-snapshotter:v8.2.0"
+ ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.8.0"
+ ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.13.1"
+ ROOK_CSI_IMAGE_PULL_POLICY: "IfNotPresent"
CSI_ENABLE_CSIADDONS: "false"
+ ROOK_CSIADDONS_IMAGE: "quay.io/csiaddons/k8s-sidecar:v0.11.0"
+ CSI_ENABLE_TOPOLOGY: "false"
ROOK_CSI_ENABLE_NFS: "false"
CSI_PLUGIN_TOLERATIONS: "- operator: Exists"
CSI_FORCE_CEPHFS_KERNEL_CLIENT: "true"
CSI_GRPC_TIMEOUT_SECONDS: "150"
CSI_PROVISIONER_REPLICAS: "2"
- CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n"
- CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n cpu: 200m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
- CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n cpu: 100m\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n cpu: 500m\n"
+ CSI_RBD_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n limits:\n memory: 1Gi\n- name : csi-omap-generator\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_RBD_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-rbdplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-resizer\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-attacher\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-snapshotter\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_CEPHFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-cephfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : liveness-prometheus\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n"
+ CSI_NFS_PROVISIONER_RESOURCE: "- name : csi-provisioner\n resource:\n requests:\n memory: 128Mi\n cpu: 100m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n- name : csi-attacher\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_NFS_PLUGIN_RESOURCE: "- name : driver-registrar\n resource:\n requests:\n memory: 128Mi\n cpu: 50m\n limits:\n memory: 256Mi\n- name : csi-nfsplugin\n resource:\n requests:\n memory: 512Mi\n cpu: 250m\n limits:\n memory: 1Gi\n"
+ CSI_CEPHFS_ATTACH_REQUIRED: "true"
+ CSI_RBD_ATTACH_REQUIRED: "true"
+ CSI_NFS_ATTACH_REQUIRED: "true"
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -269,7 +233,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
# Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint.
@@ -282,9 +246,24 @@
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- - apiGroups: ["admissionregistration.k8s.io"]
- resources: ["validatingwebhookconfigurations"]
- verbs: ["create", "get", "delete", "update"]
+ - apiGroups: ["csiaddons.openshift.io"]
+ resources: ["networkfences"]
+ verbs: ["create", "get", "update", "delete", "watch", "list", "deletecollection"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["get"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["cephconnections"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["clientprofiles"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["operatorconfigs"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
+ - apiGroups: ["csi.ceph.io"]
+ resources: ["drivers"]
+ verbs: ["create", "delete", "get", "list", "update", "watch"]
---
# Source: rook-ceph/templates/clusterrole.yaml
# The cluster role for managing all the cluster-specific resources in a namespace
@@ -296,7 +275,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -332,7 +311,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -343,9 +322,8 @@
# Node access is needed for determining nodes where mons should run
- nodes
- nodes/proxy
- - services
# Rook watches secrets which it uses to configure access to external resources.
- # e.g., external Ceph cluster; TLS certificates for the admission controller or object store
+ # e.g., external Ceph cluster or object store
- secrets
# Rook watches for changes to the rook-operator-config configmap
- configmaps
@@ -363,6 +341,7 @@
- persistentvolumeclaims
# Rook creates endpoints for mgr and object store access
- endpoints
+ - services
verbs:
- get
- list
@@ -391,6 +370,7 @@
- create
- update
- delete
+ - deletecollection
# The Rook operator must be able to watch all ceph.rook.io resources to reconcile them.
- apiGroups: ["ceph.rook.io"]
resources:
@@ -410,6 +390,7 @@
- cephfilesystemmirrors
- cephfilesystemsubvolumegroups
- cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- get
- list
@@ -478,6 +459,14 @@
- delete
- deletecollection
- apiGroups:
+ - apps
+ resources:
+ # This is to add osd deployment owner ref on key rotation
+ # cron jobs.
+ - deployments/finalizers
+ verbs:
+ - update
+ - apiGroups:
- healthchecking.openshift.io
resources:
- machinedisruptionbudgets
@@ -525,7 +514,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -586,7 +575,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
@@ -662,19 +651,19 @@
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
- resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
- - apiGroups: ["storage.k8s.io"]
- resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ resources: ["secrets"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -686,11 +675,20 @@
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
+ resources: ["configmaps"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["storage.k8s.io"]
+ resources: ["csinodes"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
@@ -699,31 +697,40 @@
verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
+ - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts"]
+ verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -734,30 +741,30 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"]
- apiGroups: [""]
- resources: ["nodes"]
- verbs: ["get", "list", "watch"]
- - apiGroups: [""]
- resources: ["namespaces"]
- verbs: ["get", "list"]
- - apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update"]
+ verbs: ["get", "list"]
- apiGroups: [""]
resources: ["configmaps"]
- verbs: ["get", "list"]
+ verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
---
# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
@@ -770,13 +777,19 @@
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
- verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
+ resources: ["storageclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["events"]
+ verbs: ["list", "watch", "create", "update", "patch"]
+ - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"]
- verbs: ["get", "list", "watch", "update", "patch"]
+ verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"]
verbs: ["patch"]
@@ -784,68 +797,64 @@
resources: ["nodes"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
- resources: ["storageclasses"]
+ resources: ["csinodes"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
+ resources: ["persistentvolumeclaims/status"]
+ verbs: ["patch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"]
- verbs: ["get", "list", "watch", "update", "patch"]
- - apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents"]
- verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+ verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshotcontents/status"]
- verbs: ["update", "patch"]
+ resources: ["volumesnapshotcontents"]
+ verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["snapshot.storage.k8s.io"]
- resources: ["volumesnapshots/status"]
+ resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotclasses"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: ["groupsnapshot.storage.k8s.io"]
+ resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications", "volumereplicationclasses"]
- verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/finalizers"]
- verbs: ["update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplications/status"]
- verbs: ["get", "patch", "update"]
- - apiGroups: ["replication.storage.openshift.io"]
- resources: ["volumereplicationclasses/status"]
- verbs: ["get"]
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get"]
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ verbs: ["create"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch"]
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrole.yaml
kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: 'psp:rook'
+ name: objectstorage-provisioner-role
labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
rules:
- - apiGroups:
- - policy
- resources:
- - podsecuritypolicies
- resourceNames:
- - 00-rook-privileged
- verbs:
- - use
+ - apiGroups: ["objectstorage.k8s.io"]
+ resources: ["buckets", "bucketaccesses", "bucketclaims", "bucketaccessclasses", "buckets/status", "bucketaccesses/status", "bucketclaims/status", "bucketaccessclasses/status"]
+ verbs: ["get", "list", "watch", "update", "create", "delete"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "watch", "list", "delete", "update", "create"]
+ - apiGroups: [""]
+ resources: ["secrets", "events"]
+ verbs: ["get", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
@@ -886,7 +895,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -907,7 +916,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -951,28 +960,30 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-nodeplugin
+ name: cephfs-csi-provisioner-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: rook-csi-cephfs-provisioner-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-csi-nodeplugin
+ name: cephfs-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
+# This is required by operator-sdk to map the cluster/clusterrolebindings with SA
+# otherwise operator-sdk will create a individual file for these.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
- name: cephfs-csi-provisioner-role
+ name: cephfs-csi-nodeplugin-role
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
+ name: rook-csi-cephfs-plugin-sa
namespace: default # namespace:operator
roleRef:
kind: ClusterRole
- name: cephfs-external-provisioner-runner
+ name: cephfs-csi-nodeplugin
apiGroup: rbac.authorization.k8s.io
---
# Source: rook-ceph/templates/clusterrolebinding.yaml
@@ -989,81 +1000,24 @@
name: rbd-external-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
+# Source: rook-ceph/templates/clusterrolebinding.yaml
+# RBAC for ceph cosi driver service account
kind: ClusterRoleBinding
-metadata:
- name: rook-ceph-system-psp
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-system
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
metadata:
- name: rook-csi-cephfs-provisioner-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-cephfs-provisioner-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-cephfs-plugin-sa-psp
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
+ name: objectstorage-provisioner-role-binding
+ labels:
+ app.kubernetes.io/part-of: container-object-storage-interface
+ app.kubernetes.io/component: driver-ceph
+ app.kubernetes.io/name: cosi-driver-ceph
subjects:
- kind: ServiceAccount
- name: rook-csi-cephfs-plugin-sa
+ name: objectstorage-provisioner
namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-plugin-sa-psp
roleRef:
- apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-plugin-sa
- namespace: default # namespace:operator
----
-# Source: rook-ceph/templates/psp.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: rook-csi-rbd-provisioner-sa-psp
-roleRef:
+ name: objectstorage-provisioner-role
apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: 'psp:rook'
-subjects:
- - kind: ServiceAccount
- name: rook-csi-rbd-provisioner-sa
- namespace: default # namespace:operator
---
# Source: rook-ceph/templates/cluster-rbac.yaml
kind: Role
@@ -1073,10 +1027,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -1085,23 +1039,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -1136,9 +1073,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -1206,7 +1165,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
rules:
- apiGroups:
@@ -1237,6 +1196,7 @@
- create
- update
- delete
+ - deletecollection
- apiGroups:
- batch
resources:
@@ -1252,6 +1212,13 @@
- get
- create
- delete
+ - apiGroups:
+ - multicluster.x-k8s.io
+ resources:
+ - serviceexports
+ verbs:
+ - get
+ - create
---
# Source: rook-ceph/templates/role.yaml
kind: Role
@@ -1260,12 +1227,6 @@
name: cephfs-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "create", "delete"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
@@ -1277,113 +1238,11 @@
name: rbd-external-provisioner-cfg
namespace: default # namespace:operator
rules:
- - apiGroups: [""]
- resources: ["endpoints"]
- verbs: ["get", "watch", "list", "delete", "update", "create"]
- - apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch", "create", "delete", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1416,22 +1275,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph/templates/cluster-rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph/templates/cluster-rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -1505,7 +1348,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -1551,51 +1394,56 @@
kind: Deployment
metadata:
name: rook-ceph-operator
+ namespace: default # namespace:operator
labels:
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
spec:
replicas: 1
selector:
matchLabels:
app: rook-ceph-operator
+ strategy:
+ type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
+ tolerations:
+ - effect: NoExecute
+ key: node.kubernetes.io/unreachable
+ operator: Exists
+ tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: "rook/ceph:v1.9.4"
+ image: "docker.io/rook/ceph:v1.16.4"
imagePullPolicy: IfNotPresent
args: ["ceph", "operator"]
securityContext:
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
- runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
- - mountPath: /etc/webhook
- name: webhook-cert
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: "false"
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: "false"
- - name: ROOK_ENABLE_SELINUX_RELABELING
- value: "true"
- name: ROOK_DISABLE_DEVICE_HOTPLUG
value: "false"
- - name: ROOK_ENABLE_DISCOVERY_DAEMON
- value: "false"
- - name: ROOK_DISABLE_ADMISSION_CONTROLLER
- value: "false"
+ - name: ROOK_DISCOVER_DEVICES_INTERVAL
+ value: "60m"
- name: NODE_NAME
valueFrom:
fieldRef:
@@ -1621,5 +1469,9 @@
emptyDir: {}
- name: default-config-dir
emptyDir: {}
- - name: webhook-cert
- emptyDir: {}
+
+# Source: rook-ceph/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{} |
|
Path: @@ -9,7 +9,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -26,7 +26,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -43,7 +43,7 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
@@ -71,12 +71,26 @@
operator: rook
storage-backend: ceph
app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
+ app.kubernetes.io/managed-by: Helm
app.kubernetes.io/created-by: helm
# imagePullSecrets:
# - name: my-registry-secret
---
+# Source: rook-ceph-cluster/templates/rbac.yaml
+# Service account for other components
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: rook-ceph-default
+ namespace: default # namespace:cluster
+ labels:
+ operator: rook
+ storage-backend: ceph
+
+# imagePullSecrets:
+# - name: my-registry-secret
+---
# Source: rook-ceph-cluster/templates/cephblockpool.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
@@ -99,6 +113,7 @@
imageFormat: "2"
reclaimPolicy: Delete
allowVolumeExpansion: true
+volumeBindingMode: Immediate
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
apiVersion: storage.k8s.io/v1
@@ -107,6 +122,7 @@
name: ceph-bucket
provisioner: default.ceph.rook.io/bucket
reclaimPolicy: Delete
+volumeBindingMode: Immediate
parameters:
objectStoreName: ceph-objectstore
objectStoreNamespace: default
@@ -150,10 +166,10 @@
namespace: default # namespace:cluster
rules:
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
- # validating the connection details
+ # validating the connection details and for key rotation operations.
- apiGroups: [""]
resources: ["secrets"]
- verbs: ["get"]
+ verbs: ["get", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
@@ -162,23 +178,6 @@
verbs: ["get", "list", "create", "update", "delete"]
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-rules:
- # Placeholder role so the rgw service account will
- # be generated in the csv. Remove this role and role binding
- # when fixing https://github.com/rook/rook/issues/10141.
- - apiGroups:
- - ""
- resources:
- - configmaps
- verbs:
- - get
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Aspects of ceph-mgr that operate within the cluster's namespace
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -213,9 +212,31 @@
- apiGroups:
- ceph.rook.io
resources:
- - "*"
+ - cephclients
+ - cephclusters
+ - cephblockpools
+ - cephfilesystems
+ - cephnfses
+ - cephobjectstores
+ - cephobjectstoreusers
+ - cephobjectrealms
+ - cephobjectzonegroups
+ - cephobjectzones
+ - cephbuckettopics
+ - cephbucketnotifications
+ - cephrbdmirrors
+ - cephfilesystemmirrors
+ - cephfilesystemsubvolumegroups
+ - cephblockpoolradosnamespaces
+ - cephcosidrivers
verbs:
- - "*"
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
- apiGroups:
- apps
resources:
@@ -310,102 +331,6 @@
- update
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-default-psp
- namespace: default # namespace:cluster
- labels:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/part-of: rook-ceph-operator
- app.kubernetes.io/managed-by: helm
- app.kubernetes.io/created-by: helm
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: default
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-rgw-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-mgr-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-mgr
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-cmd-reporter-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-cmd-reporter
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: rook-ceph-purge-osd-psp
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: psp:rook
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-purge-osd
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the operator to create resources in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -438,22 +363,6 @@
namespace: default # namespace:cluster
---
# Source: rook-ceph-cluster/templates/rbac.yaml
-# Allow the rgw pods in this namespace to work with configmaps
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: rook-ceph-rgw
-subjects:
- - kind: ServiceAccount
- name: rook-ceph-rgw
- namespace: default # namespace:cluster
----
-# Source: rook-ceph-cluster/templates/rbac.yaml
# Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -553,6 +462,7 @@
kind: Ingress
metadata:
name: default-dashboard
+ namespace: default # namespace:cluster
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
@@ -574,6 +484,12 @@
---
{}
+# Source: rook-ceph-cluster/templates/securityContextConstraints.yaml
+# scc for the Rook and Ceph daemons
+# for creating cluster in openshift
+---
+{}
+
# Source: rook-ceph-cluster/templates/volumesnapshotclass.yaml
---
{}
@@ -583,6 +499,7 @@
kind: CephBlockPool
metadata:
name: rbd
+ namespace: default # namespace:cluster
spec:
failureDomain: osd
replicated:
@@ -593,12 +510,13 @@
kind: CephCluster
metadata:
name: default
+ namespace: default # namespace:cluster
spec:
monitoring:
enabled: true
cephVersion:
allowUnsupported: false
- image: quay.io/ceph/ceph:v16.2.9
+ image: quay.io/ceph/ceph:v19.2.1
cleanupPolicy:
allowUninstallWithVolumes: false
confirmation: ""
@@ -614,8 +532,6 @@
ssl: true
dataDirHostPath: /var/lib/rook
disruptionManagement:
- machineDisruptionBudgetNamespace: openshift-machine-api
- manageMachineDisruptionBudgets: false
managePodBudgets: true
osdMaintenanceTimeout: 30
pgHealthCheckTimeout: 0
@@ -637,15 +553,24 @@
disabled: false
osd:
disabled: false
+ logCollector:
+ enabled: true
+ maxLogSize: 500M
+ periodicity: daily
mgr:
allowMultiplePerNode: false
count: 2
- modules:
- - enabled: true
- name: pg_autoscaler
+ modules: null
mon:
allowMultiplePerNode: false
count: 3
+ network:
+ connections:
+ compression:
+ enabled: false
+ encryption:
+ enabled: false
+ requireMsgr2: false
placement:
all:
nodeAffinity:
@@ -669,57 +594,53 @@
resources:
cleanup:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 100Mi
crashcollector:
limits:
- cpu: 500m
memory: 60Mi
requests:
cpu: 100m
memory: 60Mi
+ exporter:
+ limits:
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 50Mi
logcollector:
limits:
- cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 100Mi
mgr:
limits:
- cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
mgr-sidecar:
limits:
- cpu: 500m
memory: 100Mi
requests:
cpu: 100m
memory: 40Mi
mon:
limits:
- cpu: 2000m
memory: 2Gi
requests:
cpu: 1000m
memory: 1Gi
osd:
limits:
- cpu: 2000m
memory: 4Gi
requests:
cpu: 1000m
memory: 4Gi
prepareosd:
- limits:
- cpu: 500m
- memory: 200Mi
requests:
cpu: 500m
memory: 50Mi
@@ -736,6 +657,7 @@
name: storage03
useAllDevices: true
useAllNodes: true
+ upgradeOSDRequiresHealthyPGs: false
waitTimeoutForHealthyOSDInMinutes: 10
---
# Source: rook-ceph-cluster/templates/cephobjectstore.yaml
@@ -743,6 +665,7 @@
kind: CephObjectStore
metadata:
name: ceph-objectstore
+ namespace: default # namespace:cluster
spec:
dataPool:
erasureCoded: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.9.4->v1.16.4v1.9.4->v1.16.4v1.9.4->v1.16.4Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
rook/rook (rook-ceph)
v1.16.4Compare Source
Improvements
Rook v1.16.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.16.3Compare Source
Improvements
Rook v1.16.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.16.2Compare Source
Improvements
Rook v1.16.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.16.1Compare Source
Improvements
Rook v1.16.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.16.0Compare Source
Upgrade Guide
To upgrade from previous versions of Rook, see the Rook upgrade guide.
Breaking Changes
Features
statusCheckis enabled on the parent CephBlockPool.additionalConfig.bucketPolicyfield (see #15138).opsLogSidecarin the gateway settings.v1.15.8Compare Source
Improvements
Rook v1.15.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.7Compare Source
Improvements
Rook v1.15.7 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.6Compare Source
Improvements
Rook v1.15.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.5Compare Source
Improvements
Rook v1.15.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
/run/udevin the init container for ceph-volume activate (#14901, @guits)v1.15.4Compare Source
Improvements
Rook v1.15.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.3Compare Source
Improvements
Rook v1.15.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.2Compare Source
Improvements
Rook v1.15.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.15.1Compare Source
Improvements
Rook v1.15.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
mon.zonesspec (#14636, @BenoitKnecht)v1.15.0Compare Source
Upgrade Guide
To upgrade from previous versions of Rook, see the Rook upgrade guide.
Breaking Changes
csi-*plugin-holder-*in the Rook operator namespace, see the detailed documentation to disable them. This deprecation process will be required before upgrading to the future Rook v1.16.spec.hostingconfigurations are set. Use the newspec.hosting.advertiseEndpointconfig to define required behavior as documented.Features
allowDeviceClassUpdate: trueis set in the CephCluster CR.allowOsdCrushWeightUpdate: trueis set in the CephCluster CR.docker.io/rook/ceph) in operator manifests and helm charts.Experimental Features
operator.yaml.v1.14.12Compare Source
Improvements
Rook v1.14.12 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.11Compare Source
Improvements
Rook v1.14.11 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.10Compare Source
Improvements
Rook v1.14.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.9Compare Source
Improvements
Rook v1.14.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.8Compare Source
Improvements
Rook v1.14.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.7Compare Source
What's Changed
monitoring: fix CephPoolGrowthWarning expression (#14346, @matofeder)
monitoring: Set honor labels on the service monitor (#14339, @travisn)
Full Changelog: rook/rook@v1.14.6...v1.14.7
v1.14.6Compare Source
What's Changed
v1.14.5Compare Source
Improvements
Rook v1.14.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.4Compare Source
Improvements
Rook v1.14.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.3Compare Source
Improvements
Rook v1.14.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.2Compare Source
Improvements
Rook v1.14.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.1Compare Source
Improvements
Rook v1.14.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.14.0Compare Source
Upgrade Guide
To upgrade from previous versions of Rook, see the Rook upgrade guide.
Breaking Changes
repositoryandtagsettings are specified separately in the helm chart values.yaml for the CSI images. Helm users previously specifying the CSI images with theimagesetting will need to update their values.yaml with the separaterepositoryandtagsettings.csi-*plugin-holder-*in the Rook operator namespace, see the holder pod deprecation documentation to disable them. Migration of affected clusters is optional for v1.14, but will be required in a future release.CSI_ENABLE_READ_AFFINITYwas removed. v1.13 clusters that have modified this value to be"true"must set the option as desired in each CephCluster as documented here before upgrading to v1.14.Features
defaultservice account now use a newrook-ceph-defaultservice account.applicationcan be applied to a CephBlockPool CR.rook-cephnamespace).kubectloutput for Rook CRDs.v1.13.10Compare Source
Improvements
Rook v1.13.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.9Compare Source
Improvements
Rook v1.13.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.8Compare Source
Improvements
Rook v1.13.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.7Compare Source
Improvements
Rook v1.13.7 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
monitoringsection of CephCluster to ceph-exporter (#13902, @rkachach)v1.13.6Compare Source
Improvements
Rook v1.13.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
mastertag in the values.yaml with the release tag (#13897, @travisn)v1.13.5Compare Source
Improvements
Rook v1.13.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.4Compare Source
Improvements
Rook v1.13.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.3Compare Source
Improvements
Rook v1.13.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
v1.13.2Compare Source
Improvements
Rook v1.13.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.