Mount keyring and config override as files in the toolbox deployment#4026
Open
sp98 wants to merge 11 commits into
Open
Mount keyring and config override as files in the toolbox deployment#4026sp98 wants to merge 11 commits into
sp98 wants to merge 11 commits into
Conversation
Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
This variable will hold the desired cephx key generation value. Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Add a shared annotation key for CephClusters created with CephX support. Set the annotation only during CephCluster creation. Existing clusters are never annotated during reconciliation. Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Add CephX security settings to the generated CephCluster spec. Use the feature annotation to choose the compatible security spec. When the annotation exists, allow ciphers and set CSI and rbdMirrorPeer key to AES. When absent, allow ciphers and enable daemon key rotation with KeyGeneration. Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Mirror CephCluster CephX feature behavior onto managed CephClients. Annotate newly created clients with the CephX feature annotation. Set their CephX key type to AES when the annotation is present. Apply this to metrics exporter and StorageConsumer CSI clients. Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
Add CephCluster reconciliation coverage for both CephX annotation paths. Verify new clusters receive the created-with-CephX feature annotation. Verify existing clusters never gets annotated. Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
The test 'populated cache emits metrics' under TestCephFSSubvolumeCountCollectorCollect in 'cephfs_test.go' file was incorrectly checking metric values because it collected all gauge metrics with 'consumer_name' label without distinguishing between metric types. The 'pvMetadata' metrics (value=1) were overwriting the subvolumeCount values. Signed-off-by: Arun Kumar Mohan <amohan@redhat.com>
Signed-off-by: Arun Kumar Mohan <amohan@redhat.com>
sp98
force-pushed
the
update-toolbox-dep-mount-path
branch
from
9f04b28 to
206097c
Compare
iamniting
requested changes
Jul 13, 2026
| }, | ||
| }, | ||
| }, | ||
| {Name: "ceph-admin-secret", VolumeSource: corev1.VolumeSource{ |
Member
There was a problem hiding this comment.
Can you pls correct the formatting?
sp98
force-pushed
the
update-toolbox-dep-mount-path
branch
from
206097c to
f7f3113
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sp98 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
The OCS operator provides the keyring via ROOK_CEPH_SECRET env var instead of file mount. This PR mounts the keyring secret file and drops the env var. This is useful as now the toolbox script can detect the change in the keyring. Signed-off-by: Santosh <sapillai@redhat.com>
sp98
force-pushed
the
update-toolbox-dep-mount-path
branch
from
f7f3113 to
5092069
Compare
openshift-ci
Bot
added
the
needs-rebase
Contributor
Author
|
This PR is not rebased on top of #3910 which has all the Ocs operator changes for 4.22. |
openshift-ci
Bot
removed
the
needs-rebase
Contributor
|
@sp98: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
parth-gr
reviewed
Jul 13, 2026
parth-gr
left a comment
parth-gr
left a comment
Member
There was a problem hiding this comment.
is there a possibility the ceph keyring can change?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OCS operator provides the keyring via ROOK_CEPH_SECRET env var instead of file mount. This PR mounts the keyring secret and config overeide as files and drops the env var, so that toolbox can detect the change in the keyring.