Biohazard icon indicating copy to clipboard operation
Biohazard copied to clipboard

Published 20 hours ago • verified publisher icon JJGadgets

feat(helm): update chart rook-ceph to v1.15.3

Open tinfoild[bot] opened this issue 10 months ago • 4 comments

This PR contains the following updates:

Package Update Change OpenSSF
rook-ceph minor v1.13.4 -> v1.15.3 OpenSSF Scorecard

Release Notes

rook/rook (rook-ceph)

v1.15.3

Compare Source

Improvements

Rook v1.15.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.15.2

Compare Source

Improvements

Rook v1.15.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.15.1

Compare Source

Improvements

Rook v1.15.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.15.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

  • Minimum version of Kubernetes supported is increased to K8s v1.26.
  • During CephBlockPool updates, Rook will now return an error if an invalid device class is specified. Pools with invalid device classes may start failing until the correct device class is specified. For more details, see #​14057.
  • Rook has deprecated CSI network "holder" pods. If there are pods named csi-*plugin-holder-* in the Rook operator namespace, see the detailed documentation to disable them. This deprecation process will be required before upgrading to the future Rook v1.16.
  • Ceph COSI driver images have been updated. This impacts existing COSI Buckets, BucketClaims, and BucketAccesses. Update existing clusters following the guide here.
  • CephObjectStore, CephObjectStoreUser, and OBC endpoint behavior has changed when CephObjectStore spec.hosting configurations are set. Use the new spec.hosting.advertiseEndpoint config to define required behavior as documented.

Features

  • Added support for Ceph Squid (v19), in addition to Reef (v18) and Quincy (v17). Quincy support will be removed in Rook v1.16.
  • Ceph-CSI driver v3.12, including new options for RBD, log rotation, and updated sidecar images.
  • Allow updating the device class of OSDs, if allowDeviceClassUpdate: true is set in the CephCluster CR.
  • Allow updating the weight of an OSD, if allowOsdCrushWeightUpdate: true is set in the CephCluster CR.
  • Use fully-qualified image names (docker.io/rook/ceph) in operator manifests and helm charts.

Experimental Features

  • CephObjectStore support for keystone authentication for S3 and Swift. See the Object store documentation to configure.
  • CSI operator: CSI settings are moving to CRs managed by a new operator. Once enabled, Rook will convert the settings previously defined in the operator configmap or env vars into the new CRs managed by the CSI operator. There are two steps to enable:

v1.14.11

Compare Source

Improvements

Rook v1.14.11 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.10

Compare Source

Improvements

Rook v1.14.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.9

Compare Source

Improvements

Rook v1.14.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.8

Compare Source

Improvements

Rook v1.14.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.7

Compare Source

What's Changed

monitoring: fix CephPoolGrowthWarning expression (#​14346, @​matofeder) monitoring: Set honor labels on the service monitor (#​14339, @​travisn)

Full Changelog: https://github.com/rook/rook/compare/v1.14.6...v1.14.7

v1.14.6

Compare Source

What's Changed

v1.14.5

Compare Source

Improvements

Rook v1.14.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.4

Compare Source

Improvements

Rook v1.14.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.3

Compare Source

Improvements

Rook v1.14.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.2

Compare Source

Improvements

Rook v1.14.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.1

Compare Source

Improvements

Rook v1.14.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.14.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

  • The minimum supported version of Kubernetes is v1.25. Upgrade to Kubernetes v1.25 or higher before upgrading Rook.
  • The image repository and tag settings are specified separately in the helm chart values.yaml for the CSI images. Helm users previously specifying the CSI images with the image setting will need to update their values.yaml with the separate repository and tag settings.
  • Rook is beginning the process of deprecating CSI network "holder" pods. If there are pods named csi-*plugin-holder-* in the Rook operator namespace, see the holder pod deprecation documentation to disable them. Migration of affected clusters is optional for v1.14, but will be required in a future release.
  • The Rook operator config CSI_ENABLE_READ_AFFINITY was removed. v1.13 clusters that have modified this value to be "true" must set the option as desired in each CephCluster as documented here before upgrading to v1.14.

Features

  • Kubernetes versions v1.25 through v1.29 are supported. K8s v1.30 will be supported as soon as released.
  • Ceph daemon pods using the default service account now use a new rook-ceph-default service account.
  • A custom Ceph application can be applied to a CephBlockPool CR.
  • Object stores can be created with shared metadata and data pools. Isolation between object stores is enabled via RADOS namespaces. This configuration is recommended to limit the number of pools when multiple object stores are created.
  • Support for VolumeSnapshotGroup is available for the RBD and CephFS CSI drivers.
  • Support for virtual style hosting for s3 buckets is added in the CephObjectStore, by adding hosting.dnsNames to the object store.
  • A static prefix can be specified for the CSI drivers and OBC provisioner (the default prefix is the rook-ceph namespace).
  • Azure Key Vault KMS support is added for storing OSD encryption keys.
  • Additional status columns added to the kubectl output for Rook CRDs.

v1.13.10

Compare Source

Improvements

Rook v1.13.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.9

Compare Source

Improvements

Rook v1.13.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.8

Compare Source

Improvements

Rook v1.13.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.7

Compare Source

Improvements

Rook v1.13.7 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.6

Compare Source

Improvements

Rook v1.13.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.5

Compare Source

Improvements

Rook v1.13.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

tinfoild[bot] avatar Apr 03 '24 20:04 tinfoild[bot]

Deploying jjgadgets-biohazard with  Cloudflare Pages  Cloudflare Pages

Latest commit: ae79f35
Status: ✅  Deploy successful!
Preview URL: https://311246cd.jjgadgets-biohazard.pages.dev
Branch Preview URL: https://renovate-rook-ceph-1-x.jjgadgets-biohazard.pages.dev

View logs

cloudflare-workers-and-pages[bot] avatar Apr 03 '24 20:04 cloudflare-workers-and-pages[bot] 

--- kube/deploy/core/storage/rook-ceph/app Kustomization: flux-system/1-core-storage-rook-ceph-app HelmRelease: rook-ceph/rook-ceph

+++ kube/deploy/core/storage/rook-ceph/app Kustomization: flux-system/1-core-storage-rook-ceph-app HelmRelease: rook-ceph/rook-ceph

@@ -12,13 +12,13 @@

     spec:
       chart: rook-ceph
       sourceRef:
         kind: HelmRepository
         name: rook-ceph
         namespace: flux-system
-      version: v1.13.4
+      version: v1.15.4
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

tinfoild[bot] avatar Apr 03 '24 20:04 tinfoild[bot] 

--- HelmRelease: rook-ceph/rook-ceph ConfigMap: rook-ceph/rook-ceph-operator-config

+++ HelmRelease: rook-ceph/rook-ceph ConfigMap: rook-ceph/rook-ceph-operator-config

@@ -9,31 +9,39 @@

   ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: '15'
   ROOK_OBC_WATCH_OPERATOR_NAMESPACE: 'true'
   ROOK_CEPH_ALLOW_LOOP_DEVICES: 'false'
   ROOK_ENABLE_DISCOVERY_DAEMON: 'false'
   ROOK_CSI_ENABLE_RBD: 'true'
   ROOK_CSI_ENABLE_CEPHFS: 'true'
+  ROOK_CSI_DISABLE_DRIVER: 'false'
   CSI_ENABLE_CEPHFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_NFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_RBD_SNAPSHOTTER: 'true'
   CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: 'false'
   CSI_ENABLE_ENCRYPTION: 'false'
   CSI_ENABLE_OMAP_GENERATOR: 'false'
   CSI_ENABLE_HOST_NETWORK: 'true'
+  CSI_DISABLE_HOLDER_PODS: 'true'
   CSI_ENABLE_METADATA: 'true'
+  CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: 'true'
   CSI_PLUGIN_PRIORITY_CLASSNAME: system-node-critical
   CSI_PROVISIONER_PRIORITY_CLASSNAME: system-cluster-critical
   CSI_RBD_FSGROUPPOLICY: File
   CSI_CEPHFS_FSGROUPPOLICY: File
   CSI_NFS_FSGROUPPOLICY: File
   CSI_CEPHFS_KERNEL_MOUNT_OPTIONS: ms_mode=prefer-secure,recover_session=clean
+  ROOK_CSI_CEPH_IMAGE: quay.io/cephcsi/cephcsi:v3.12.2
+  ROOK_CSI_REGISTRAR_IMAGE: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1
+  ROOK_CSI_PROVISIONER_IMAGE: registry.k8s.io/sig-storage/csi-provisioner:v5.0.1
+  ROOK_CSI_SNAPSHOTTER_IMAGE: registry.k8s.io/sig-storage/csi-snapshotter:v8.0.1
+  ROOK_CSI_ATTACHER_IMAGE: registry.k8s.io/sig-storage/csi-attacher:v4.6.1
+  ROOK_CSI_RESIZER_IMAGE: registry.k8s.io/sig-storage/csi-resizer:v1.11.1
   ROOK_CSI_IMAGE_PULL_POLICY: IfNotPresent
   CSI_ENABLE_CSIADDONS: 'true'
-  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.8.0
+  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.9.1
   CSI_ENABLE_TOPOLOGY: 'false'
-  CSI_ENABLE_READ_AFFINITY: 'true'
   ROOK_CSI_ENABLE_NFS: 'false'
   CSI_FORCE_CEPHFS_KERNEL_CLIENT: 'true'
   CSI_GRPC_TIMEOUT_SECONDS: '150'
   CSI_PROVISIONER_REPLICAS: '2'
   CSI_RBD_PROVISIONER_RESOURCE: |
     - name : csi-provisioner
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rook-ceph-system

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rook-ceph-system

@@ -32,13 +32,58 @@

   - create
   - get
   - update
   - delete
   - watch
   - list
+  - deletecollection
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
   - get
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - cephconnections
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - clientprofiles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - operatorconfigs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - drivers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-csi-nodeplugin

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-csi-nodeplugin

@@ -7,7 +7,31 @@

 - apiGroups:
   - ''
   resources:
   - nodes
   verbs:
   - get
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-external-provisioner-runner

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-external-provisioner-runner

@@ -11,13 +11,27 @@

   verbs:
   - get
   - list
 - apiGroups:
   - ''
   resources:
+  - configmaps
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
   - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - csinodes
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
@@ -84,12 +98,16 @@

   - snapshot.storage.k8s.io
   resources:
   - volumesnapshots
   verbs:
   - get
   - list
+  - watch
+  - update
+  - patch
+  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotclasses
   verbs:
   - get
@@ -102,14 +120,52 @@

   verbs:
   - get
   - list
   - watch
   - patch
   - update
+  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotcontents/status
   verbs:
   - update
   - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rbd-external-provisioner-runner

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rbd-external-provisioner-runner

@@ -93,12 +93,15 @@

   resources:
   - volumesnapshots
   verbs:
   - get
   - list
   - watch
+  - update
+  - patch
+  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotclasses
   verbs:
   - get
@@ -111,16 +114,42 @@

   verbs:
   - get
   - list
   - watch
   - patch
   - update
+  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotcontents/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents/status
   verbs:
   - update
   - patch
 - apiGroups:
   - ''
   resources:
@@ -144,15 +173,7 @@

   resources:
   - nodes
   verbs:
   - get
   - list
   - watch
-- apiGroups:
-  - storage.k8s.io
-  resources:
-  - csinodes
-  verbs:
-  - get
-  - list
-  - watch
 
--- HelmRelease: rook-ceph/rook-ceph Role: rook-ceph/rook-ceph-rgw

+++ HelmRelease: rook-ceph/rook-ceph Role: rook-ceph/rook-ceph-rgw

@@ -1,14 +0,0 @@

----
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: rook-ceph-rgw
-  namespace: rook-ceph
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - configmaps
-  verbs:
-  - get
-
--- HelmRelease: rook-ceph/rook-ceph RoleBinding: rook-ceph/rook-ceph-rgw

+++ HelmRelease: rook-ceph/rook-ceph RoleBinding: rook-ceph/rook-ceph-rgw

@@ -1,15 +0,0 @@

----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: rook-ceph-rgw
-  namespace: rook-ceph
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: rook-ceph-rgw
-subjects:
-- kind: ServiceAccount
-  name: rook-ceph-rgw
-  namespace: rook-ceph
-
--- HelmRelease: rook-ceph/rook-ceph Deployment: rook-ceph/rook-ceph-operator

+++ HelmRelease: rook-ceph/rook-ceph Deployment: rook-ceph/rook-ceph-operator

@@ -26,13 +26,13 @@

       - effect: NoExecute
         key: node.kubernetes.io/unreachable
         operator: Exists
         tolerationSeconds: 5
       containers:
       - name: rook-ceph-operator
-        image: rook/ceph:v1.13.4
+        image: docker.io/rook/ceph:v1.15.4
         imagePullPolicy: IfNotPresent
         args:
         - ceph
         - operator
         securityContext:
           capabilities:
--- HelmRelease: rook-ceph/rook-ceph ServiceAccount: rook-ceph/rook-ceph-default

+++ HelmRelease: rook-ceph/rook-ceph ServiceAccount: rook-ceph/rook-ceph-default

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rook-ceph-default
+  namespace: rook-ceph
+  labels:
+    operator: rook
+    storage-backend: ceph
+

tinfoild[bot] avatar Apr 03 '24 20:04 tinfoild[bot]

TODO: add new VolumeSnapshotGroup CRD before merging

JJGadgets avatar Apr 06 '24 12:04 JJGadgets