Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(rook-ceph): update rook-ceph group to v1.13.1 (minor) #2247

Merged
merged 1 commit into from
Jan 2, 2024

Conversation

tyriis-automation[bot]
Copy link
Contributor

@tyriis-automation tyriis-automation bot commented Dec 13, 2023

This PR contains the following updates:

Package Update Change OpenSSF
rook-ceph minor v1.12.10 -> v1.13.1 OpenSSF Scorecard
rook-ceph-cluster minor v1.12.10 -> v1.13.1 OpenSSF Scorecard

Release Notes

rook/rook (rook-ceph)

v1.13.1

Compare Source

Improvements

Rook v1.13.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

v1.13.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes
  • Removed support for Ceph Pacific (v16). Ceph Quincy (v17) and Ceph Reef (v18) are the only currently supported versions.
  • The minimum supported Kubernetes version is v1.23
  • The minimum supported Ceph-CSI driver is 3.9
  • The admission controller is removed. If the admission controller is enabled (it is disabled by default), it is recommended to be disabled before the upgrade. See the upgrade guide for more details.
Features
  • Added experimental cephConfig to the CephCluster CR to allow setting Ceph config options in the Ceph MON config store via the CRD. These settings supersede the ceph.conf override settings.
  • CephCSI v3.10 is now the default CSI driver version.
  • The default CephFS SubvolumeGroup has pinning enabled by default to distribute load across MDS ranks in predictable and stable ways.
  • The Ceph exporter daemon is updated to use a Ceph keyring with reduced privileges instead of the admin keyring.
  • If the host network setting changes in the CephCluster CR, the mons will now automatically failover to enable the new configuration.
  • Allow for additional advanced maintenance and troubleshooting of Ceph daemons, by respecting the label ceph.rook.io/do-not-reconcile for all Ceph daemons. This is helpful when using the debug command in the kubectl rook-ceph plugin.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@tyriis-automation tyriis-automation bot added renovate/flux renovate flux manager renovate/helm renovate helm datasource type/minor a minor update area/kubernetes cluster/talos-flux labels Dec 13, 2023
@tyriis-automation
Copy link
Contributor Author

tyriis-automation bot commented Dec 13, 2023

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ EDITORCONFIG editorconfig-checker 2 0 0.02s
✅ REPOSITORY gitleaks yes no 2.09s
✅ YAML prettier 2 0 0.68s
✅ YAML yamllint 2 0 0.36s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

@tyriis-automation
Copy link
Contributor Author

tyriis-automation bot commented Dec 14, 2023

--- kubernetes HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system

+++ kubernetes HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system

@@ -22,21 +22,12 @@

   - ''
   resources:
   - pods/exec
   verbs:
   - create
 - apiGroups:
-  - admissionregistration.k8s.io
-  resources:
-  - validatingwebhookconfigurations
-  verbs:
-  - create
-  - get
-  - delete
-  - update
-- apiGroups:
   - csiaddons.openshift.io
   resources:
   - networkfences
   verbs:
   - create
   - get
--- kubernetes HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config

+++ kubernetes HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config

@@ -6,13 +6,12 @@

   namespace: rook-ceph
 data:
   ROOK_LOG_LEVEL: INFO
   ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: '15'
   ROOK_OBC_WATCH_OPERATOR_NAMESPACE: 'true'
   ROOK_CEPH_ALLOW_LOOP_DEVICES: 'false'
-  ROOK_DISABLE_ADMISSION_CONTROLLER: 'true'
   ROOK_ENABLE_DISCOVERY_DAEMON: 'false'
   ROOK_CSI_ENABLE_RBD: 'true'
   ROOK_CSI_ENABLE_CEPHFS: 'true'
   CSI_ENABLE_CEPHFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_NFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_RBD_SNAPSHOTTER: 'true'
@@ -24,13 +23,12 @@

   CSI_PLUGIN_PRIORITY_CLASSNAME: system-node-critical
   CSI_PROVISIONER_PRIORITY_CLASSNAME: system-cluster-critical
   CSI_RBD_FSGROUPPOLICY: File
   CSI_CEPHFS_FSGROUPPOLICY: File
   CSI_NFS_FSGROUPPOLICY: File
   ROOK_CSI_KUBELET_DIR_PATH: /var/lib/kubelet
-  ROOK_CSI_ENABLE_GRPC_METRICS: 'false'
   ROOK_CSI_IMAGE_PULL_POLICY: IfNotPresent
   CSI_ENABLE_CSIADDONS: 'false'
   ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.7.0
   CSI_ENABLE_TOPOLOGY: 'false'
   CSI_ENABLE_READ_AFFINITY: 'false'
   ROOK_CSI_ENABLE_NFS: 'false'
--- kubernetes HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator

+++ kubernetes HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator

@@ -19,34 +19,36 @@

     type: Recreate
   template:
     metadata:
       labels:
         app: rook-ceph-operator
     spec:
+      tolerations:
+      - effect: NoExecute
+        key: node.kubernetes.io/unreachable
+        operator: Exists
+        tolerationSeconds: 5
       containers:
       - name: rook-ceph-operator
-        image: rook/ceph:v1.12.10
+        image: rook/ceph:v1.13.0
         imagePullPolicy: IfNotPresent
         args:
         - ceph
         - operator
         securityContext:
+          capabilities:
+            drop:
+            - ALL
+          runAsGroup: 2016
           runAsNonRoot: true
           runAsUser: 2016
-          runAsGroup: 2016
         volumeMounts:
         - mountPath: /var/lib/rook
           name: rook-config
         - mountPath: /etc/ceph
           name: default-config-dir
-        - mountPath: /etc/webhook
-          name: webhook-cert
-        ports:
-        - containerPort: 9443
-          name: https-webhook
-          protocol: TCP
         env:
         - name: ROOK_CURRENT_NAMESPACE_ONLY
           value: 'false'
         - name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
           value: 'false'
         - name: ROOK_DISABLE_DEVICE_HOTPLUG
@@ -74,9 +76,7 @@

       serviceAccountName: rook-ceph-system
       volumes:
       - name: rook-config
         emptyDir: {}
       - name: default-config-dir
         emptyDir: {}
-      - name: webhook-cert
-        emptyDir: {}
 
--- kubernetes HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global

+++ kubernetes HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global

@@ -13,13 +13,12 @@

 - apiGroups:
   - ''
   resources:
   - pods
   - nodes
   - nodes/proxy
-  - services
   - secrets
   - configmaps
   verbs:
   - get
   - list
   - watch
@@ -27,12 +26,13 @@

   - ''
   resources:
   - events
   - persistentvolumes
   - persistentvolumeclaims
   - endpoints
+  - services
   verbs:
   - get
   - list
   - watch
   - patch
   - create

@tyriis-automation
Copy link
Contributor Author

tyriis-automation bot commented Dec 14, 2023

--- kubernetes/talos-flux/apps/rook-ceph/rook-ceph/operator Kustomization: flux-system/apps-rook-ceph-operator HelmRelease: rook-ceph/rook-ceph-operator

+++ kubernetes/talos-flux/apps/rook-ceph/rook-ceph/operator Kustomization: flux-system/apps-rook-ceph-operator HelmRelease: rook-ceph/rook-ceph-operator

@@ -9,13 +9,13 @@

     spec:
       chart: rook-ceph
       sourceRef:
         kind: HelmRepository
         name: rook-ceph-charts
         namespace: flux-system
-      version: v1.12.10
+      version: v1.13.0
   install:
     remediation:
       retries: 5
   interval: 30m
   upgrade:
     remediation:
--- kubernetes/talos-flux/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/apps-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

+++ kubernetes/talos-flux/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/apps-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

@@ -9,13 +9,13 @@

     spec:
       chart: rook-ceph-cluster
       sourceRef:
         kind: HelmRepository
         name: rook-ceph-charts
         namespace: flux-system
-      version: v1.12.10
+      version: v1.13.0
   dependsOn:
   - name: rook-ceph-operator
     namespace: rook-ceph
   install:
     remediation:
       retries: 5

@tyriis tyriis added the stop-updating prevent renovate from updating this pr label Dec 14, 2023
@tyriis-automation tyriis-automation bot changed the title feat(rook-ceph): update rook-ceph group to v1.13.0 (minor) feat(rook-ceph): update rook-ceph group to v1.13.1 (minor) Dec 27, 2023
Copy link

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@tyriis-automation
Copy link
Contributor Author

--- kubernetes/talos-flux/apps/rook-ceph/rook-ceph/operator Kustomization: flux-system/apps-rook-ceph-operator HelmRelease: rook-ceph/rook-ceph-operator

+++ kubernetes/talos-flux/apps/rook-ceph/rook-ceph/operator Kustomization: flux-system/apps-rook-ceph-operator HelmRelease: rook-ceph/rook-ceph-operator

@@ -12,13 +12,13 @@

     spec:
       chart: rook-ceph
       sourceRef:
         kind: HelmRepository
         name: rook-ceph-charts
         namespace: flux-system
-      version: v1.12.10
+      version: v1.13.1
   install:
     remediation:
       retries: 5
   interval: 30m
   upgrade:
     remediation:
--- kubernetes/talos-flux/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/apps-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

+++ kubernetes/talos-flux/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/apps-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

@@ -12,13 +12,13 @@

     spec:
       chart: rook-ceph-cluster
       sourceRef:
         kind: HelmRepository
         name: rook-ceph-charts
         namespace: flux-system
-      version: v1.12.10
+      version: v1.13.1
   dependsOn:
   - name: rook-ceph-operator
     namespace: rook-ceph
   install:
     remediation:
       retries: 5

@tyriis-automation
Copy link
Contributor Author

--- HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config

+++ HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config

@@ -6,13 +6,12 @@

   namespace: rook-ceph
 data:
   ROOK_LOG_LEVEL: INFO
   ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: '15'
   ROOK_OBC_WATCH_OPERATOR_NAMESPACE: 'true'
   ROOK_CEPH_ALLOW_LOOP_DEVICES: 'false'
-  ROOK_DISABLE_ADMISSION_CONTROLLER: 'true'
   ROOK_ENABLE_DISCOVERY_DAEMON: 'false'
   ROOK_CSI_ENABLE_RBD: 'true'
   ROOK_CSI_ENABLE_CEPHFS: 'true'
   CSI_ENABLE_CEPHFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_NFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_RBD_SNAPSHOTTER: 'true'
@@ -24,16 +23,15 @@

   CSI_PLUGIN_PRIORITY_CLASSNAME: system-node-critical
   CSI_PROVISIONER_PRIORITY_CLASSNAME: system-cluster-critical
   CSI_RBD_FSGROUPPOLICY: File
   CSI_CEPHFS_FSGROUPPOLICY: File
   CSI_NFS_FSGROUPPOLICY: File
   ROOK_CSI_KUBELET_DIR_PATH: /var/lib/kubelet
-  ROOK_CSI_ENABLE_GRPC_METRICS: 'false'
   ROOK_CSI_IMAGE_PULL_POLICY: IfNotPresent
   CSI_ENABLE_CSIADDONS: 'false'
-  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.7.0
+  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.8.0
   CSI_ENABLE_TOPOLOGY: 'false'
   CSI_ENABLE_READ_AFFINITY: 'false'
   ROOK_CSI_ENABLE_NFS: 'false'
   CSI_FORCE_CEPHFS_KERNEL_CLIENT: 'true'
   CSI_GRPC_TIMEOUT_SECONDS: '150'
   CSI_PROVISIONER_REPLICAS: '2'
--- HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system

+++ HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system

@@ -22,21 +22,12 @@

   - ''
   resources:
   - pods/exec
   verbs:
   - create
 - apiGroups:
-  - admissionregistration.k8s.io
-  resources:
-  - validatingwebhookconfigurations
-  verbs:
-  - create
-  - get
-  - delete
-  - update
-- apiGroups:
   - csiaddons.openshift.io
   resources:
   - networkfences
   verbs:
   - create
   - get
--- HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global

+++ HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global

@@ -13,13 +13,12 @@

 - apiGroups:
   - ''
   resources:
   - pods
   - nodes
   - nodes/proxy
-  - services
   - secrets
   - configmaps
   verbs:
   - get
   - list
   - watch
@@ -27,12 +26,13 @@

   - ''
   resources:
   - events
   - persistentvolumes
   - persistentvolumeclaims
   - endpoints
+  - services
   verbs:
   - get
   - list
   - watch
   - patch
   - create
--- HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator

+++ HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator

@@ -19,34 +19,36 @@

     type: Recreate
   template:
     metadata:
       labels:
         app: rook-ceph-operator
     spec:
+      tolerations:
+      - effect: NoExecute
+        key: node.kubernetes.io/unreachable
+        operator: Exists
+        tolerationSeconds: 5
       containers:
       - name: rook-ceph-operator
-        image: rook/ceph:v1.12.10
+        image: rook/ceph:v1.13.1
         imagePullPolicy: IfNotPresent
         args:
         - ceph
         - operator
         securityContext:
+          capabilities:
+            drop:
+            - ALL
+          runAsGroup: 2016
           runAsNonRoot: true
           runAsUser: 2016
-          runAsGroup: 2016
         volumeMounts:
         - mountPath: /var/lib/rook
           name: rook-config
         - mountPath: /etc/ceph
           name: default-config-dir
-        - mountPath: /etc/webhook
-          name: webhook-cert
-        ports:
-        - containerPort: 9443
-          name: https-webhook
-          protocol: TCP
         env:
         - name: ROOK_CURRENT_NAMESPACE_ONLY
           value: 'false'
         - name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
           value: 'false'
         - name: ROOK_DISABLE_DEVICE_HOTPLUG
@@ -74,9 +76,7 @@

       serviceAccountName: rook-ceph-system
       volumes:
       - name: rook-config
         emptyDir: {}
       - name: default-config-dir
         emptyDir: {}
-      - name: webhook-cert
-        emptyDir: {}
 

@tyriis tyriis merged commit b3dfbdb into main Jan 2, 2024
14 checks passed
@tyriis tyriis deleted the renovate/rook-ceph branch January 2, 2024 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/kubernetes cluster/talos-flux renovate/flux renovate flux manager renovate/helm renovate helm datasource stop-updating prevent renovate from updating this pr type/minor a minor update
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant