Commit Graph

142273 Commits

Author SHA1 Message Date
Adam Kupczyk
4c1966645f
Merge pull request #61892 from k0ste/wip-70068-reef
reef: os/bluestore: fix the problem that _estimate_log_size_N calculates the log size incorrectly
2025-03-11 19:33:12 +01:00
Adam King
f3093595a3
Merge pull request #62162 from phlogistonjohn/wip-70345-reef
reef: build-with-container: fixes and enhancements

Reviewed-by: Adam King <adking@redhat.com>
2025-03-10 16:02:05 -04:00
Yuri Weinstein
55fb540837
Merge pull request #62175 from idryomov/wip-64063-reef
reef: rbd-nbd: use netlink interface by default

Reviewed-by: Ramana Raja <rraja@redhat.com>
2025-03-10 11:04:56 -04:00
Venky Shankar
16b9de4637
Merge pull request #61379 from vshankar/wip-reef-client-secfix
reef: client: disallow unprivileged users to escalate root privileges

Reviewed-by: Milind Changire <mchangir@redhat.com>
2025-03-10 17:47:17 +05:30
Anthony D'Atri
58f50f1271
Merge pull request #62193 from zdover23/wip-doc-2025-03-10-backport-62176-to-reef
reef: doc/releases: Add ordering comment to releases.yml
2025-03-10 00:41:43 -04:00
Anthony D'Atri
c5801f7ff8 doc/releases: Add ordering comment to releases.yml
Signed-off-by: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
(cherry picked from commit 2290a904bd)
2025-03-10 13:30:01 +10:00
Dan Mick
1f324f52fe
Merge pull request #62065 from dmick/wip-70241-reef
reef: container/build.sh: remove local container images
2025-03-07 16:17:31 -08:00
Yuri Weinstein
7d3ec84213
Merge pull request #62129 from idryomov/wip-65720-reef
reef: librbd: add rbd_diff_iterate3() API to take source snapshot by ID

Reviewed-by: Vinay Bhaskar Varada <vvarada@redhat.com>
2025-03-07 15:24:43 -05:00
Yuri Weinstein
27a78e16cb
Merge pull request #62127 from idryomov/wip-70190-reef
reef: librbd: fix a deadlock on image_lock caused by Mirror::image_disable()

Reviewed-by: Vinay Bhaskar Varada <vvarada@redhat.com>
2025-03-07 15:23:19 -05:00
Ilya Dryomov
a2d3f3b764 Revert "test/librbd/fsx: switch to netlink interface for rbd-nbd"
This reverts commit 1a128a8d8c.

With commit fcbf7367d2 ("rbd-nbd: map using netlink interface by
default") backported to reef, this reef-only fixup limited to fsx is no
longer needed.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2025-03-07 21:09:13 +01:00
Ramana Raja
b70160ac4d rbd-nbd: map using netlink interface by default
Mapping rbd images to nbd devices using ioctl interface is not
robust. It was discovered that the device size or the md5 checksum
of the nbd device was incorrect immediately after mapping using
ioctl method. When using the nbd netlink interface to map RBD images
the issue was not encountered. Switch to using nbd netlink interface
for mapping.

Fixes: https://tracker.ceph.com/issues/64063
Signed-off-by: Ramana Raja <rraja@redhat.com>
(cherry picked from commit fcbf7367d2)

Conflicts:
	PendingReleaseNotes [ moved to >=18.2.5 section ]
2025-03-07 21:05:56 +01:00
David Galloway
cdc9635303
Merge pull request #62037 from ceph/template-reef
Links to Jenkins jobs in PR comment commands / Remove deprecated commands
2025-03-07 14:42:36 -05:00
Ilya Dryomov
8d014f171f test/pybind/rbd: fix read offset in write zeroes tests
Random data is written and write zeroes is invoked on 0~256, but the
read is done on 256~256.  This means that if write zeroes malfunctions
the test wouldn't catch it (especially in the thick provision case).

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit d41f0fa01f)
2025-03-07 11:57:53 +01:00
VinayBhaskar-V
dd64132044 librbd: add rbd_diff_iterate3() API to take source snapshot by ID
Allow a diff to start from a non-user snapshot.  This would be used by
"rbd du" command to account for non-user snapshots which are currently
just skipped potentially resulting in underreported space usage and in
other places.

Fixes: https://tracker.ceph.com/issues/65720
Co-authored-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Vinay Bhaskar Varada <vvarada@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit 54f47cc28f)

Conflicts:
	src/include/rbd/librbd.h [ commit e5ccce14c4 ("rbd: add group
	  snap info command") not in reef ]
	src/test/pybind/test_rbd.py [ commit d7fd66ec99 ("librbd: add
	  rbd_clone4() API to take parent snapshot by ID") not in reef ]
2025-03-07 11:57:53 +01:00
John Mulligan
c5748f0871 doc: document the new container build tool and link to it in README
Add a new markdown file in the root of the tree, ContainerBuild.md, that
can serve as a basic introduction to the new container build tools
recently merged to ceph.
Add a small 'breadcrumb' section to the project README.md to help find
this new document.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 313546146c)
2025-03-06 16:14:28 -05:00
John Mulligan
895ffc9989 script/build-with-container: add support for overlay dir
The source dir (aka homedir, default /ceph) is mounted in the container
read-write. This is needed as the various ceph build scripts expect to
write things into the tree - often this is in the build directory - but
not always. This can lead to small messes and/or situations that are
confusing to debug, especially if one is jumping between distros often.
Add an option to use an overlay volume for the homedir - by default we
enable a persistent overlay with a supplied "upper dir" where files that
were written will appear. One can also enable a temporary overlay that
forgets the writes when the container exits - maybe useful when doing
experiments in 'interactive' mode.

To use this option run the command with the `--overlay=<dir>` option.
For example: `./src/script/build-with-container.py -b build.inner
--overlay-dir build.ovr`. This will create a directory
`build.ovr/content` automatically and all new files will appear there.
For example the build directory will appear at
`build.ovr/content/build.inner`.

To use the temporary overlay use a `-` as the directory name. For
example: `./src/script/build-with-container.py -b build.inner
--overlay-dir -`

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 794e3d0b25)
2025-03-06 16:14:28 -05:00
John Mulligan
08f7626d72 script/build-with-container: skip dnf cache dir volume mounts on docker
When using docker the --volume option is not available during build
(docker [buildx] build), unlike podman. Since passing these volumes must
be conditional on them being set up I see no way to handle this short of
just disabling the option on docker. Log the fact that it's being
skipped - the only other issue is that we pointlessly set up some dirs
and the build may be a bit slower.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 4208a73665)
2025-03-06 16:14:27 -05:00
John Mulligan
e56df19133 script/build-with-container: remove default --volume arg from ctr build
On the original github pr #59841 user fayak kindly informed us that the
--volume option was not supported by docker build. Since this section
was a leftover from a previous way of constructing the builder image and
was no longer needed we simply removed it.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 612a9d6808)
2025-03-06 16:14:27 -05:00
John Mulligan
915f6210d7 script/build-with-container.py: build builder image with --pull=always
Construct the builder image using the --pull=always flag to initiate a
pull of the base image (centos, ubuntu, etc) in order to avoid using a
stale base image. Since the script automatically (by default) avoids
building if a matching tag is in local container storage it is handy to
use a fresh base when it *is* time to build something. Otherwise, you
end up in a situation like I sometimes do - using a months old base
unintentionally.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit f6e6188e30)
2025-03-06 16:14:27 -05:00
John Mulligan
de0d927944 script/build-with-container: add a common packages target
Add a `packages` target to build-with-container.py that requests a build
of packages, whatever package type is native to the distro selected.
For example `./src/script/build-with-container.py -d ubuntu22.04 -e
packages` will automatically select a deb packages build where
`./src/script/build-with-container.py -d centos9 -e packages` will
trigger rpm packages to be built. The underlying package-type specific
targets remain unchanged.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 37b7d509c5)
2025-03-06 16:14:27 -05:00
John Mulligan
5d7ff135f6 script/build-with-container: support custom tag suffixes
Previously, one could use the `--tag` option to completely override the
container tag generated by the script. However, there are cases where
one may want to add information to the tag rather than override it.
Allow the tag value to start with a plus (+) character that indicates
that the remainder of the string is to be suffixed to the generated tag.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 30836c4ed4)
2025-03-06 16:14:27 -05:00
John Mulligan
8a3e3af0fa script/build-with-container: add --base-branch cli option
Add a command line option --base-branch that allows the user to supply a
custom base branch name. git doesn't make determining this easy so we
always assume a base branch of 'main' by default - but this option lets
one change that.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit ff34bf7241)
2025-03-06 16:14:27 -05:00
John Mulligan
4304f848e6 src/script: rename CEPH_BRANCH to CEPH_BASE_BRANCH for build container
Previously, we were passing build argument of CEPH_BRANCH, but that was
a bit misleading as we expect the current branch to vary a bit (as users
will be using branches to develop and test the code). What we actually
care about is the base branch ('main', 'squid', etc) as that is fed into
our bootstrap script and we want the option to simple variations based
on the name of said base branch.
Rename CEPH_BRANCH to CEPH_BASE_BRANCH for clarity.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit a1d49d557c)
2025-03-06 16:14:27 -05:00
John Mulligan
98be912957 script/build-with-container: add --current-branch cli option
Add a new --current-branch argument that lets the user supply a name for
the current branch. This allows the automatic tag generation to avoid
calling git - something useful if the tree is not using a git checkout
(like a tarball). It also allows you to pull a temporary branch in git
but ignore it and act like the temporary branch is the base branch.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit c1713c5bc3)
2025-03-06 16:14:27 -05:00
John Mulligan
0adecbe761 script/build-with-container: add more distro aliases
Add a system to define distro name aliases and use that to define some
additional aliases, primarily to match ubuntu codenames rather than
version numbers. Requested by Zack.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 65f055f0d8)
2025-03-06 16:14:27 -05:00
John Mulligan
a1c73426ea script/build-with-container: apply black formatting to file
After the last set of fixes and enhancements I forgot to reformat the
file. This applies standard `black` formatting to the file.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit de855aec1c)
2025-03-06 16:14:27 -05:00
Adam Emerson
e4751d5b21
Merge pull request #61531 from soumyakoduri/wip-skoduri-reef
reef: rgw: Fix LC process stuck issue

Reviewed-by: Daniel Gryniewicz <dang@redhat.com>
2025-03-06 00:21:33 -05:00
Yuri Weinstein
2db28f8e95
Merge pull request #55431 from adk3798/reef-mcltf-true
reef: qa/tasks/cephadm: enable mon_cluster_log_to_file

Reviewed-by: Laura Flores <lflores@redhat.com>
Reviewed-by: Ilya Dryomov <idryomov@redhat.com>
2025-03-05 10:43:20 -08:00
NitzanMordhai
3f5efed5ed
Merge pull request #61434 from idryomov/wip-57864-reef
reef: qa/tasks: Include stderr on tasks badness check.
2025-03-05 18:53:57 +02:00
Ilya Dryomov
bea8997761 librbd: fix a deadlock on image_lock caused by Mirror::image_disable()
With Mirror::image_disable() taking image_lock for write and calling
list_children() under it, the following deadlock is possible:

1. Mirror::image_disable() takes image_lock for write and calls
   list_children()
2. AbstractWriteLog::periodic_stats() timer fires (it runs every
   5 seconds) and ImageCacheState::write_image_cache_state() is called
   under a global timer_lock
3. ImageCacheState::write_image_cache_state() successfully takes
   owner_lock and blocks attempting to take image_lock for read because
   it's already held for write by Mirror::image_disable()
4. list_children() blocks inside of a call to ImageState::close() on
   a descendant image
5. The descendant image close can't proceed because TokenBucketThrottle
   requires a global timer_lock to complete QosImageDispatch shutdown
6. safe_timer thread which is holding timer_lock can't proceed because
   ImageCacheState::write_image_cache_state() is effectively blocked on
   the descendant image close through Mirror::image_disable()

Until commit 281a64acf9 ("librbd: remove snapshot mirror image-meta
when disabling"), Mirror::image_disable() was taking image_lock only for
read meaning that this deadlock wasn't possible.  The only other change
that commit 281a64acf9 made to the code block protected by image_lock
was using child_mirror_image_internal for cls_client::mirror_image_get()
call on descendant images instead of mirror_image_internal to preserve
the value of mirror_image_internal for later.  Both are local variables
that have nothing to do with image_lock, so I'm going back and making
Mirror::image_disable() take image_lock only for read again.

Fixes: https://tracker.ceph.com/issues/70190
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit ff9aa20bc3)
2025-03-05 13:28:55 +01:00
Yuri Weinstein
86dddfdc3f
Merge pull request #62104 from cbodley/wip-70152
reef: qa/rgw: avoid 'user rm' of keystone users

Reviewed-by: Daniel Gryniewicz <dang@redhat.com>
2025-03-04 13:50:26 -08:00
Casey Bodley
d3510e5b41 qa/rgw: avoid 'user rm' of keystone users
partial backport of 2390788b89 did not
include a nearby change from ff81a31ad6

Fixes: https://tracker.ceph.com/issues/70152

Signed-off-by: Casey Bodley <cbodley@redhat.com>
2025-03-04 09:43:29 -05:00
Zac Dover
a97554fcfb
Merge pull request #61575 from zdover23/wip-doc-2025-01-30-backport-61566-to-reef
reef: doc/cephadm: simplify confusing math proposition

Reviewed-by: Anthony D'Atri <anthony.datri@gmail.com>
2025-03-04 21:57:19 +10:00
SrinivasaBharathKanta
ebe369c04e
Merge pull request #56408 from batrick/wip-65082-reef
reef: mon: do not log MON_DOWN if monitor uptime is less than threshold
2025-03-04 04:14:45 +05:30
Yuri Weinstein
85cc598f56
Merge pull request #62046 from pritha-srivastava/wip-69257-reef
reef: rgw/sts: fix to disallow unsupported JWT algorithms

Reviewed-by: Casey Bodley <cbodley@redhat.com>
2025-03-03 13:31:17 -08:00
Yuri Weinstein
90fe2af09c
Merge pull request #62045 from nbalacha/wip-70098-reef
reef: librbd: fix a crash in get_rollback_snap_id

Reviewed-by: Ilya Dryomov <idryomov@redhat.com>
2025-03-03 13:30:38 -08:00
Yuri Weinstein
b4ec8b15e6
Merge pull request #62043 from nbalacha/wip-69983-reef
reef: rbd-mirror: fix possible recursive lock of ImageReplayer::m_lock

Reviewed-by: Ilya Dryomov <idryomov@redhat.com>
2025-03-03 10:18:10 -08:00
Casey Bodley
941acaa71e
Merge pull request #61595 from yuvalif/wip-63630-reef
reef: rgw/test/kafka: let consumer read events from the beginning

Reviewed-by: J. Eric Ivancich <ivancich@redhat.com>
2025-03-03 12:07:56 -05:00
afreen23
aa0fc9b6e8
Merge pull request #61973 from rhcs-dashboard/wip-70122-reef
reef: mgr/dashboard: disable deleting bucket with objects

Reviewed-by: Afreen Misbah <afreen@ibm.com>
2025-03-03 11:04:26 +05:30
Anthony D'Atri
01f43c5496
Merge pull request #62078 from zdover23/wip-doc-2025-03-03-backport-62076-to-reef
reef: doc/rados/operations: Clarify stretch mode vs device class
2025-03-02 16:10:40 -05:00
Anthony D'Atri
a26958ace6 doc/rados/operations: Clarify stretch mode vs device class
Signed-off-by: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
(cherry picked from commit 75be0272e8)
2025-03-03 06:53:23 +10:00
Ronen Friedman
0e14878de2
Merge pull request #61403 from ronen-fr/wip-rf-61289-reef
reef: common: fix md_config_cacher_t

Reviewed-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
2025-03-01 09:43:09 +02:00
Dan Mick
04bbf9c7f0 container/build.sh: remove local container images
Optionally, for those that want to run build.sh locally and
use the images.  The default is to remove, for Jenkins builders,
which will build, push, and rmi.

Fixes: https://tracker.ceph.com/issues/70196
Signed-off-by: Dan Mick <dan.mick@redhat.com>
(cherry picked from commit 642e5f2da0)
2025-02-28 13:36:56 -08:00
Ilya Dryomov
5555ae2b27 qa/workunits/rbd: add a test for force promote with a user snapshot
Add a reproducer for the crash on a bad variant access which was fixed
in commit 7d75161051 ("librbd: fix a crash in get_rollback_snap_id").

The reproducer deliberately works around many other issues with force
promote in snapshot-based mirroring: stopping rbd-mirror daemon
shouldn't be necessary (let alone with SIGKILL), get_rollback_snap_id()
and its caller can_create_primary_snapshot() are flawed and can pick
the wrong snapshot to roll back to or skip rollback when it's actually
required, the user snapshot in this scenario should be removed as part
of force promoting because it's incomplete and won't be usable after
the image is promoted, etc.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit 0f4a37dd9f)

Conflicts:
	qa/workunits/rbd/rbd_mirror_journal.sh [ commits 3fd8a03887
	  ("qa/workunits/rbd: merge journal and snapshot test scripts")
	  and 3fdbc160bb ("rbd-mirror: allow mirroring to a different
	  namespace") not in reef ]
	qa/workunits/rbd/rbd_mirror_snapshot.sh [ duplicated/cloned for
	  snapshot-based mirroring ]
2025-02-28 20:47:57 +01:00
Anthony D'Atri
49605d41b0
Merge pull request #62057 from zdover23/wip-doc-2025-02-28-backport-61626-to-reef
reef: doc/rados: improve pg_num/pgp_num info
2025-02-28 10:30:23 -05:00
Zac Dover
a99eb3d6e7 doc/rados: improve pg_num/pgp_num info
Improve the guidance around setting pg_num, and clear up confusion
around whether pgp_num should be set manually or, indeed, if it even can
be set manually.

This PR was raised in response to Mark Schouten's email here: https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/CBDJTLTTIEZVG7GVZBX37UAWGYNSSMPD/

Co-authored-by: Anthony D'Atri <anthony.datri@gmail.com>
Signed-off-by: Zac Dover <zac.dover@proton.me>
(cherry picked from commit c43e733721)
2025-02-28 22:27:25 +10:00
Naman Munet
a2ca1d6c84 mgr/dashboard: disable deleting bucket with objects
Fixes: https://tracker.ceph.com/issues/70078

Signed-off-by: Naman Munet <naman.munet@ibm.com>
(cherry picked from commit 11677c29ee)

 Conflicts:
	src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-list/rgw-bucket-list.component.ts
2025-02-28 15:06:11 +05:30
afreen23
9e899118b6
Merge pull request #61980 from rhcs-dashboard/wip-70139-reef
reef: mgr/dashboard: critical confirmation modal changes

Reviewed-by: Afreen Misbah <afreen@ibm.com>
2025-02-28 13:48:44 +05:30
Pritha Srivastava
6dddeccd52 [CVE-2024-48916] rgw/sts: fix to disallow unsupported JWT algorithms
while authenticating AssumeRoleWithWebIdentity using JWT obtained
from an external IDP.

fixes: https://tracker.ceph.com/issues/68836

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
(cherry picked from commit 919da36966)
2025-02-28 10:05:14 +05:30
N Balachandran
0ca05d740d librbd: fix a crash in get_rollback_snap_id
get_rollback_snap_id() did not check if the snapshot it was
accessing was a mirror snapshot, causing it to crash if it wasn't.

Fixes: https://tracker.ceph.com/issues/70075

Signed-off-by: N Balachandran <nithya.balachandran@ibm.com>
(cherry picked from commit 7d75161051)
2025-02-28 08:57:34 +05:30