--- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for Ceph OSDs kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for Ceph mgrs kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-mgr namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for the job that reports the Ceph version in an image kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-cmd-reporter namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for job that purges OSDs from a Rook-Ceph cluster kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-purge-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for RGW server kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-rgw namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for other components kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-default namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/rbac.yaml # Service account for NVMe-oF gateway kind: ServiceAccount apiVersion: v1 metadata: name: rook-ceph-nvmeof namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" # imagePullSecrets: # - name: my-registry-secret --- # Source: rook-ceph-cluster/templates/cephblockpool.yaml kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: "ceph-block" annotations: storageclass.kubernetes.io/is-default-class: "true" provisioner: rook-ceph.rbd.csi.ceph.com parameters: pool: "ceph-blockpool" clusterID: "default" csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner csi.storage.k8s.io/controller-expand-secret-namespace: 'default' csi.storage.k8s.io/controller-publish-secret-name: rook-csi-rbd-provisioner csi.storage.k8s.io/controller-publish-secret-namespace: 'default' csi.storage.k8s.io/fstype: ext4 csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node csi.storage.k8s.io/node-stage-secret-namespace: 'default' csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner csi.storage.k8s.io/provisioner-secret-namespace: 'default' imageFeatures: layering imageFormat: "2" reclaimPolicy: Delete allowVolumeExpansion: true volumeBindingMode: Immediate --- # Source: rook-ceph-cluster/templates/cephfilesystem.yaml kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: ceph-filesystem annotations: storageclass.kubernetes.io/is-default-class: "false" provisioner: rook-ceph.cephfs.csi.ceph.com parameters: fsName: ceph-filesystem pool: ceph-filesystem-data0 clusterID: default csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner csi.storage.k8s.io/controller-expand-secret-namespace: 'default' csi.storage.k8s.io/controller-publish-secret-name: rook-csi-cephfs-provisioner csi.storage.k8s.io/controller-publish-secret-namespace: 'default' csi.storage.k8s.io/fstype: ext4 csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node csi.storage.k8s.io/node-stage-secret-namespace: 'default' csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner csi.storage.k8s.io/provisioner-secret-namespace: 'default' reclaimPolicy: Delete allowVolumeExpansion: true volumeBindingMode: Immediate --- # Source: rook-ceph-cluster/templates/cephobjectstore.yaml kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: ceph-bucket provisioner: default.ceph.rook.io/bucket reclaimPolicy: Delete volumeBindingMode: Immediate parameters: objectStoreName: ceph-objectstore objectStoreNamespace: default region: us-east-1 --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-cluster-default labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: rook-ceph-mgr-cluster subjects: - kind: ServiceAccount name: rook-ceph-mgr namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the ceph osd to access cluster-wide resources necessary for determining their topology location kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd-default labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: rook-ceph-osd subjects: - kind: ServiceAccount name: rook-ceph-osd namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" rules: # this is needed for rook's "key-management" CLI to fetch the vault token from the secret when # validating the connection details and for key rotation operations. - apiGroups: [""] resources: ["secrets"] verbs: ["get", "update"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch", "create", "update", "delete"] - apiGroups: ["ceph.rook.io"] resources: ["cephclusters", "cephclusters/finalizers"] verbs: ["get", "list", "create", "update", "delete"] --- # Source: rook-ceph-cluster/templates/rbac.yaml # Aspects of ceph-mgr that operate within the cluster's namespace kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" rules: - apiGroups: - "" resources: - pods - services - pods/log verbs: - get - list - watch - create - update - delete - apiGroups: - batch resources: - jobs verbs: - get - list - watch - create - update - delete - apiGroups: - ceph.rook.io resources: - cephclients - cephclusters - cephclusters/finalizers - cephblockpools - cephfilesystems - cephnfses - cephnvmeofgateways - cephobjectstores - cephobjectstoreusers - cephobjectrealms - cephobjectzonegroups - cephobjectzones - cephbuckettopics - cephbucketnotifications - cephrbdmirrors - cephfilesystemmirrors - cephfilesystemsubvolumegroups - cephblockpoolradosnamespaces - cephcosidrivers verbs: - get - list - watch - create - update - delete - patch - apiGroups: - apps resources: - deployments/scale - deployments verbs: - patch - delete - apiGroups: - '' resources: - persistentvolumeclaims verbs: - delete --- # Source: rook-ceph-cluster/templates/rbac.yaml kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" rules: - apiGroups: - "" resources: - pods - configmaps verbs: - get - list - watch - create - update - delete --- # Source: rook-ceph-cluster/templates/rbac.yaml # Aspects of ceph osd purge job that require access to the cluster namespace kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "delete"] - apiGroups: ["batch"] resources: ["jobs"] verbs: ["get", "list", "delete"] - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "update", "delete", "list"] --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the operator to create resources in this cluster's namespace kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cluster-mgmt namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: rook-ceph-cluster-mgmt subjects: - kind: ServiceAccount name: rook-ceph-system namespace: rook-ceph # namespace:operator --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the osd pods in this namespace to work with configmaps kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: rook-ceph-osd subjects: - kind: ServiceAccount name: rook-ceph-osd namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the ceph mgr to access resources scoped to the CephCluster namespace necessary for mgr modules kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: rook-ceph-mgr subjects: - kind: ServiceAccount name: rook-ceph-mgr namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the ceph mgr to access resources in the Rook operator namespace necessary for mgr modules kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-system-default namespace: rook-ceph # namespace:operator labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: rook-ceph-mgr-system subjects: - kind: ServiceAccount name: rook-ceph-mgr namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: rook-ceph-cmd-reporter subjects: - kind: ServiceAccount name: rook-ceph-cmd-reporter namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/rbac.yaml # Allow the osd purge job to run in this namespace kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: default # namespace:cluster labels: operator: rook storage-backend: ceph app.kubernetes.io/name: rook-ceph app.kubernetes.io/instance: rook-ceph-cluster app.kubernetes.io/version: v1.19.5 app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/created-by: helm helm.sh/chart: "rook-ceph-cluster-v1.19.5" roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: rook-ceph-purge-osd subjects: - kind: ServiceAccount name: rook-ceph-purge-osd namespace: default # namespace:cluster --- # Source: rook-ceph-cluster/templates/cephblockpool.yaml kind: CephBlockPool apiVersion: ceph.rook.io/v1 metadata: name: ceph-blockpool namespace: default # namespace:cluster spec: failureDomain: host replicated: size: 3 --- # Source: rook-ceph-cluster/templates/cephcluster.yaml apiVersion: ceph.rook.io/v1 kind: CephCluster metadata: name: "default" namespace: "default" # namespace:cluster spec: monitoring: enabled: false cephVersion: image: "quay.io/ceph/ceph:v19.2.3" allowUnsupported: false cleanupPolicy: allowUninstallWithVolumes: false confirmation: "" sanitizeDisks: dataSource: zero iteration: 1 method: quick continueUpgradeAfterChecksEvenIfNotHealthy: false crashCollector: disable: false dashboard: enabled: true ssl: true dataDirHostPath: /var/lib/rook disruptionManagement: managePodBudgets: true osdMaintenanceTimeout: 30 healthCheck: daemonHealth: mon: disabled: false interval: 45s osd: disabled: false interval: 60s status: disabled: false interval: 60s livenessProbe: mgr: disabled: false mon: disabled: false osd: disabled: false logCollector: enabled: true maxLogSize: 500M periodicity: daily mgr: allowMultiplePerNode: false count: 2 modules: null mon: allowMultiplePerNode: false count: 3 network: connections: compression: enabled: false encryption: enabled: false requireMsgr2: false priorityClassNames: mgr: system-cluster-critical mon: system-node-critical osd: system-node-critical removeOSDsIfOutAndSafeToRemove: false resources: cleanup: limits: memory: 1Gi requests: cpu: 500m memory: 100Mi crashcollector: limits: memory: 60Mi requests: cpu: 100m memory: 60Mi exporter: limits: memory: 128Mi requests: cpu: 50m memory: 50Mi logcollector: limits: memory: 1Gi requests: cpu: 100m memory: 100Mi mgr: limits: memory: 1Gi requests: cpu: 500m memory: 512Mi mgr-sidecar: limits: memory: 100Mi requests: cpu: 100m memory: 40Mi mon: limits: memory: 2Gi requests: cpu: 1000m memory: 1Gi osd: limits: memory: 4Gi requests: cpu: 1000m memory: 4Gi prepareosd: requests: cpu: 500m memory: 50Mi skipUpgradeChecks: false storage: useAllDevices: true useAllNodes: true upgradeOSDRequiresHealthyPGs: false waitTimeoutForHealthyOSDInMinutes: 10 --- # Source: rook-ceph-cluster/templates/cephfilesystem.yaml kind: CephFilesystem apiVersion: ceph.rook.io/v1 metadata: name: ceph-filesystem namespace: default # namespace:cluster spec: dataPools: - failureDomain: host name: data0 replicated: size: 3 metadataPool: replicated: size: 3 metadataServer: activeCount: 1 activeStandby: true priorityClassName: system-cluster-critical resources: limits: memory: 4Gi requests: cpu: 1000m memory: 4Gi --- # Source: rook-ceph-cluster/templates/cephfilesystem.yaml kind: CephFilesystemSubVolumeGroup apiVersion: ceph.rook.io/v1 metadata: name: ceph-filesystem-csi # lets keep the svg crd name same as `filesystem name + csi` for the default csi svg namespace: default # namespace:cluster spec: # The name of the subvolume group. If not set, the default is the name of the subvolumeGroup CR. name: csi # filesystemName is the metadata name of the CephFilesystem CR where the subvolume group will be created filesystemName: ceph-filesystem # reference https://docs.ceph.com/en/latest/cephfs/fs-volumes/#pinning-subvolumes-and-subvolume-groups # only one out of (export, distributed, random) can be set at a time # by default pinning is set with value: distributed=1 # for disabling default values set (distributed=0) pinning: distributed: 1 # distributed=<0, 1> (disabled=0) # export: # export=<0-256> (disabled=-1) # random: # random=[0.0, 1.0](disabled=0.0) --- # Source: rook-ceph-cluster/templates/cephobjectstore.yaml kind: CephObjectStore apiVersion: ceph.rook.io/v1 metadata: name: ceph-objectstore namespace: default # namespace:cluster spec: dataPool: erasureCoded: codingChunks: 1 dataChunks: 2 failureDomain: host parameters: bulk: "true" gateway: instances: 1 port: 80 priorityClassName: system-cluster-critical resources: limits: memory: 2Gi requests: cpu: 1000m memory: 1Gi metadataPool: failureDomain: host replicated: size: 3 preservePoolsOnDelete: true