diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c5168cc4bd..727eebcf08 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -10,7 +10,6 @@ # Bharath Sreekanth (bharathsreekanth) # Deepak Ghivari (Deepak-Ghivari) # Sean Gallacher (gallacher) -# Marek Suski (mareksuski-dell) # MaƂgorzata Dutka (mdutka-dell) # Matt Schmaelzle (mjsdell) # Mukesh Gandharva (mgandharva) @@ -23,4 +22,4 @@ # Shayna Finocchiaro (shaynafinocchiaro) # Shefali Malhotra (shefali-malhotra) -* @atye @bharathsreekanth @Deepak-Ghivari @gallacher @mareksuski-dell @mdutka-dell @mgandharva @mjsdell @prablr79 @rajendraindukuri @rajkumar-palani @rsedlock1958 @shanmydell @sharont58 @shaynafinocchiaro @shefali-malhotra +* @atye @bharathsreekanth @Deepak-Ghivari @gallacher @mdutka-dell @mgandharva @mjsdell @prablr79 @rajendraindukuri @rajkumar-palani @rsedlock1958 @shanmydell @sharont58 @shaynafinocchiaro @shefali-malhotra diff --git a/config.toml b/config.toml index 864d367c7e..919f68ed82 100644 --- a/config.toml +++ b/config.toml @@ -172,19 +172,19 @@ enable = false # icon = "fa fa-envelope" # desc = "Discuss development issues around the project" [[params.versions]] - version = "Current(v1.10.2)" + version = "Current(v1.11.0)" url = "https://dell.github.io/csm-docs/docs/" [[params.versions]] - version = "v1.9.4" + version = "v1.10.2" url = "https://dell.github.io/csm-docs/v1" [[params.versions]] - version = "v1.8.0" + version = "v1.9.4" url = "https://dell.github.io/csm-docs/v2" [[params.versions]] - version = "v1.7.1" + version = "v1.8.0" url = "https://dell.github.io/csm-docs/v3" [[menu.main]] diff --git a/content/docs/applicationmobility/release/_index.md b/content/docs/applicationmobility/release/_index.md index b252668f77..69c92138a5 100644 --- a/content/docs/applicationmobility/release/_index.md +++ b/content/docs/applicationmobility/release/_index.md @@ -6,7 +6,7 @@ Description: > Release Notes --- -## Release Notes - CSM Application Mobility v1.0.2 +## Release Notes - CSM Application Mobility v1.0.4 ### New Features/Changes diff --git a/content/docs/authorization/_index.md b/content/docs/authorization/_index.md index 04dc1f89d4..a1b5c26051 100644 --- a/content/docs/authorization/_index.md +++ b/content/docs/authorization/_index.md @@ -6,7 +6,7 @@ Description: > Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization --- -[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products. +[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products. CSM for Authorization provides storage and Kubernetes administrators the ability to apply RBAC for Dell CSI Drivers. It does this by deploying a proxy between the CSI driver and the storage system to enforce role-based access and usage rules. @@ -14,55 +14,4 @@ Storage administrators of compatible storage platforms will be able to apply quo Kubernetes administrators will have an interface to create, delete, and manage roles/groups that storage rules may be applied. Administrators and/or users may then generate authentication tokens that may be used by tenants to use storage with proper access policies being automatically enforced. -The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator. - -![CSM for Authorization](./karavi-authorization-example.png "CSM for Authorization") - -## CSM for Authorization Capabilities -{{}} -| Feature | PowerFlex | PowerMax | PowerScale | Unity XT | PowerStore | -| - | - | - | - | - | - | -| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No (natively supported) | No | No | -| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No (natively supported) | No | No | -| Ability to shield storage credentials from Kubernetes administrators ensuring credentials are only handled by storage admins | Yes | Yes | Yes | No | No | -{{
}} - -**NOTE:** PowerScale OneFS implements its own form of Role-Based Access Control (RBAC). CSM for Authorization does not enforce any role-based restrictions for PowerScale. To configure RBAC for PowerScale, refer to the PowerScale OneFS [documentation](https://www.dell.com/support/home/en-us/product-support/product/isilon-onefs/docs). - -## Authorization Components Support Matrix -CSM for Authorization consists of 2 components - The authorization sidecar, bundled with the driver, communicates with the Authorization proxy server to validate access to Storage platforms. The authorization sidecar is backward compatible with older Authorization proxy server versions. However, it is highly recommended to have the Authorization proxy server and sidecar installed from the same release of CSM. - -**NOTE:** If the deployed CSI driver has a number of controller pods equal to the number of schedulable nodes in your cluster, CSM for Authorization may not be able to inject properly into the driver's controller pod. -To resolve this, please refer to our [troubleshooting guide](./troubleshooting) on the topic. - -## Roles and Responsibilities - -The CSM for Authorization CLI can be executed in the context of the following roles: -- Storage Administrators -- Kubernetes Tenant Administrators - -### Storage Administrators - -Storage Administrators can perform the following operations within CSM for Authorization - -- Tenant Management (create, get, list, delete, bind roles, unbind roles) -- Token Management (generate, revoke) -- Storage System Management (create, get, list, update, delete) -- Storage Access Roles Management (assign to a storage system with an optional quota) - -### Tenant Administrators - -Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests. - -### Workflow - -1) Tenant Admin requests storage from a Storage Admin. -2) Storage Admin uses CSM Authorization CLI to:
- a) Create a tenant resource.
- b) Create a role permitting desired storage access.
- c) Assign the role to the tenant and generate a token.
-3) Storage Admin returns a token to the Tenant Admin. -4) Tenant Admin inputs the Token into their Kubernetes cluster as a Secret. -5) Tenant Admin updates CSI driver with CSM Authorization sidecar module. - -![CSM for Authorization Workflow](./design2.png "CSM for Authorization Workflow") +Currently, we have two versions of Authorization, **v1.x GA** and **v2.0 Tech Preview**. \ No newline at end of file diff --git a/content/docs/authorization/Backup and Restore/_index.md b/content/docs/authorization/v1.x GA/Backup and Restore/_index.md similarity index 100% rename from content/docs/authorization/Backup and Restore/_index.md rename to content/docs/authorization/v1.x GA/Backup and Restore/_index.md diff --git a/content/docs/authorization/Backup and Restore/helm/_index.md b/content/docs/authorization/v1.x GA/Backup and Restore/helm/_index.md similarity index 100% rename from content/docs/authorization/Backup and Restore/helm/_index.md rename to content/docs/authorization/v1.x GA/Backup and Restore/helm/_index.md diff --git a/content/docs/authorization/Backup and Restore/rpm/_index.md b/content/docs/authorization/v1.x GA/Backup and Restore/rpm/_index.md similarity index 100% rename from content/docs/authorization/Backup and Restore/rpm/_index.md rename to content/docs/authorization/v1.x GA/Backup and Restore/rpm/_index.md diff --git a/content/docs/authorization/v1.x GA/_index.md b/content/docs/authorization/v1.x GA/_index.md new file mode 100644 index 0000000000..21d8e269ef --- /dev/null +++ b/content/docs/authorization/v1.x GA/_index.md @@ -0,0 +1,62 @@ +--- +title: Authorization - v1.x GA +linktitle: v1.x GA +weight: 4 +Description: > + Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x GA. +tags: + - csm-authorization +--- + +The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator. + +![CSM for Authorization](./karavi-authorization-example.png "CSM for Authorization") + +## CSM for Authorization Capabilities +{{}} +| Feature | PowerFlex | PowerMax | PowerScale | Unity XT | PowerStore | +| - | - | - | - | - | - | +| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No (natively supported) | No | No | +| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No (natively supported) | No | No | +| Ability to shield storage credentials from Kubernetes administrators ensuring credentials are only handled by storage admins | Yes | Yes | Yes | No | No | +{{
}} + +**NOTE:** PowerScale OneFS implements its own form of Role-Based Access Control (RBAC). CSM for Authorization does not enforce any role-based restrictions for PowerScale. To configure RBAC for PowerScale, refer to the PowerScale OneFS [documentation](https://www.dell.com/support/home/en-us/product-support/product/isilon-onefs/docs). + +## Authorization Components Support Matrix +CSM for Authorization consists of 2 components - The authorization sidecar, bundled with the driver, communicates with the Authorization proxy server to validate access to Storage platforms. The authorization sidecar is backward compatible with older Authorization proxy server versions. However, it is highly recommended to have the Authorization proxy server and sidecar installed from the same release of CSM. + +**NOTE:** If the deployed CSI driver has a number of controller pods equal to the number of schedulable nodes in your cluster, CSM for Authorization may not be able to inject properly into the driver's controller pod. +To resolve this, please refer to our [troubleshooting guide](./troubleshooting) on the topic. + +## Roles and Responsibilities + +The CSM for Authorization CLI can be executed in the context of the following roles: +- Storage Administrators +- Kubernetes Tenant Administrators + +### Storage Administrators + +Storage Administrators can perform the following operations within CSM for Authorization + +- Tenant Management (create, get, list, delete, bind roles, unbind roles) +- Token Management (generate, revoke) +- Storage System Management (create, get, list, update, delete) +- Storage Access Roles Management (assign to a storage system with an optional quota) + +### Tenant Administrators + +Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests. + +### Workflow + +1) Tenant Admin requests storage from a Storage Admin. +2) Storage Admin uses CSM Authorization CLI to:
+ a) Create a tenant resource.
+ b) Create a role permitting desired storage access.
+ c) Assign the role to the tenant and generate a token.
+3) Storage Admin returns a token to the Tenant Admin. +4) Tenant Admin inputs the Token into their Kubernetes cluster as a Secret. +5) Tenant Admin updates CSI driver with CSM Authorization sidecar module. + +![CSM for Authorization Workflow](./design2.png "CSM for Authorization Workflow") diff --git a/content/docs/authorization/cli.md b/content/docs/authorization/v1.x GA/cli.md similarity index 100% rename from content/docs/authorization/cli.md rename to content/docs/authorization/v1.x GA/cli.md diff --git a/content/docs/authorization/configuration/_index.md b/content/docs/authorization/v1.x GA/configuration/_index.md similarity index 100% rename from content/docs/authorization/configuration/_index.md rename to content/docs/authorization/v1.x GA/configuration/_index.md diff --git a/content/docs/authorization/configuration/powerflex/_index.md b/content/docs/authorization/v1.x GA/configuration/powerflex/_index.md similarity index 83% rename from content/docs/authorization/configuration/powerflex/_index.md rename to content/docs/authorization/v1.x GA/configuration/powerflex/_index.md index 06c0e803cc..dd24f52ca4 100644 --- a/content/docs/authorization/configuration/powerflex/_index.md +++ b/content/docs/authorization/v1.x GA/configuration/powerflex/_index.md @@ -55,7 +55,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -78,7 +78,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Operator** - Refer to the [Create Secret](../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Create Secret](../../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -102,7 +102,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization. - Update `authorization.enabled` to `true`. @@ -119,8 +119,8 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization enabled: true # sidecarProxyImage: the container image used for the csm-authorization-sidecar. - # Default value: dellemc/csm-authorization-sidecar:v1.10.0 - sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0 + # Default value: dellemc/csm-authorization-sidecar:v1.11.0 + sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0 # proxyHost: hostname of the csm-authorization server # Default value: None @@ -136,7 +136,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Operator** - Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powerflex/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. + Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powerflex/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. Under `modules`, enable the module named `authorization`: @@ -156,10 +156,10 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization - name: authorization # enable: Enable/Disable csm-authorization enabled: true - configVersion: v1.10.0 + configVersion: v1.11.0 components: - name: karavi-authorization-proxy - image: dellemc/csm-authorization-sidecar:v1.10.0 + image: dellemc/csm-authorization-sidecar:v1.11.0 envs: # proxyHost: hostname of the csm-authorization server - name: "PROXY_HOST" @@ -172,4 +172,4 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization 6. Install the Dell CSI PowerFlex driver following the appropriate documenation for your installation method. -7. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list. \ No newline at end of file +7. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list. diff --git a/content/docs/authorization/configuration/powermax/_index.md b/content/docs/authorization/v1.x GA/configuration/powermax/_index.md similarity index 73% rename from content/docs/authorization/configuration/powermax/_index.md rename to content/docs/authorization/v1.x GA/configuration/powermax/_index.md index 4003f65efd..8032a47bb1 100644 --- a/content/docs/authorization/configuration/powermax/_index.md +++ b/content/docs/authorization/v1.x GA/configuration/powermax/_index.md @@ -55,17 +55,17 @@ Create the karavi-authorization-config secret using this command: **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax. Leave `username` and `password` with the default values as they will be ignored. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax. Leave `username` and `password` with the default values as they will be ignored. **Operator** - Refer to the [Install the Driver](../../../deployment/csmoperator/drivers/powermax/#install-driver) section to prepare `powermax-creds.yaml`. Leave `username` and `password` with the default values as they will be ignored. + Refer to the [Install the Driver](../../../../deployment/csmoperator/drivers/powermax/#install-driver) section to prepare `powermax-creds.yaml`. Leave `username` and `password` with the default values as they will be ignored. 5. Enable CSM Authorization in the driver installation applicable to your installation method. **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. - Update `global.storageArrays.endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -79,6 +79,8 @@ Create the karavi-authorization-config secret using this command: - Update `authorization.skipCertificateValidation` to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. + - Update `csireverseproxy.deployAsSidecar` to `true`. + Example: ```yaml @@ -89,12 +91,20 @@ Create the karavi-authorization-config secret using this command: managementServers: - endpoint: https://localhost:9400 + csireverseproxy: + # Set enabled to true if you want to deploy csireverseproxy as sidecar + # Allowed values: + # "true" - CSI reverse proxy will be deployed as a sidecar + # "false" - CSI reverse proxy will be deployed along with driver + # Default value: "true" + deployAsSidecar: true + authorization: enabled: true # sidecarProxyImage: the container image used for the csm-authorization-sidecar. - # Default value: dellemc/csm-authorization-sidecar:v1.10.0 - sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0 + # Default value: dellemc/csm-authorization-sidecar:v1.11.0 + sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0 # proxyHost: hostname of the csm-authorization server # Default value: None @@ -110,7 +120,7 @@ Create the karavi-authorization-config secret using this command: **Operator** - Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powermax/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. + Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powermax/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. Under `modules`, enable the module named `authorization`: @@ -122,18 +132,30 @@ Create the karavi-authorization-config secret using this command: - Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. + - Update the `DeployAsSidecar` environment variable for the `csipowermax-reverseproxy` component to `true`. + Example: ```yaml modules: + - name: csireverseproxy + # enabled: Always set to true + enabled: true + forceRemoveModule: true + configVersion: v2.10.0 + components: + - name: csipowermax-reverseproxy + envs: + - name: "DeployAsSidecar" + value: "true" # Authorization: enable csm-authorization for RBAC - name: authorization # enable: Enable/Disable csm-authorization enabled: true - configVersion: v1.10.0 + configVersion: v1.11.0 components: - name: karavi-authorization-proxy - image: dellemc/csm-authorization-sidecar:v1.10.0 + image: dellemc/csm-authorization-sidecar:v1.11.0 envs: # proxyHost: hostname of the csm-authorization server - name: "PROXY_HOST" @@ -146,4 +168,4 @@ Create the karavi-authorization-config secret using this command: 5. Install the Dell CSI PowerMax driver following the appropriate documenation for your installation method. -6. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list. \ No newline at end of file +6. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list. diff --git a/content/docs/authorization/configuration/powerscale/_index.md b/content/docs/authorization/v1.x GA/configuration/powerscale/_index.md similarity index 83% rename from content/docs/authorization/configuration/powerscale/_index.md rename to content/docs/authorization/v1.x GA/configuration/powerscale/_index.md index 58c0f19c91..914e09a1cc 100644 --- a/content/docs/authorization/configuration/powerscale/_index.md +++ b/content/docs/authorization/v1.x GA/configuration/powerscale/_index.md @@ -56,7 +56,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -82,7 +82,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Operator** - Refer to the [Prerequisite](../../../deployment/csmoperator/drivers/powerscale/#prerequisite) section to prepare the `secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Prerequisite](../../../../deployment/csmoperator/drivers/powerscale/#prerequisite) section to prepare the `secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -110,7 +110,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Helm** - Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization. + Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization. - Update `authorization.enabled` to `true`. @@ -127,8 +127,8 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= enabled: true # sidecarProxyImage: the container image used for the csm-authorization-sidecar. - # Default value: dellemc/csm-authorization-sidecar:v1.10.0 - sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0 + # Default value: dellemc/csm-authorization-sidecar:v1.11.0 + sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0 # proxyHost: hostname of the csm-authorization server # Default value: None @@ -144,7 +144,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Operator** - Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powerscale/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. + Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powerscale/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. Under `modules`, enable the module named `authorization`: @@ -162,10 +162,10 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= - name: authorization # enable: Enable/Disable csm-authorization enabled: true - configVersion: v1.10.0 + configVersion: v1.11.0 components: - name: karavi-authorization-proxy - image: dellemc/csm-authorization-sidecar:v1.10.0 + image: dellemc/csm-authorization-sidecar:v1.11.0 envs: # proxyHost: hostname of the csm-authorization server - name: "PROXY_HOST" @@ -178,4 +178,4 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= 6. Install the Dell CSI PowerScale driver following the appropriate documenation for your installation method. -7. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list. \ No newline at end of file +7. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list. diff --git a/content/docs/authorization/configuration/proxy-server/_index.md b/content/docs/authorization/v1.x GA/configuration/proxy-server/_index.md similarity index 100% rename from content/docs/authorization/configuration/proxy-server/_index.md rename to content/docs/authorization/v1.x GA/configuration/proxy-server/_index.md diff --git a/content/docs/authorization/design.md b/content/docs/authorization/v1.x GA/design.md similarity index 100% rename from content/docs/authorization/design.md rename to content/docs/authorization/v1.x GA/design.md diff --git a/content/docs/authorization/design1.png b/content/docs/authorization/v1.x GA/design1.png similarity index 100% rename from content/docs/authorization/design1.png rename to content/docs/authorization/v1.x GA/design1.png diff --git a/content/docs/authorization/design2.png b/content/docs/authorization/v1.x GA/design2.png similarity index 100% rename from content/docs/authorization/design2.png rename to content/docs/authorization/v1.x GA/design2.png diff --git a/content/docs/authorization/karavi-authorization-example.png b/content/docs/authorization/v1.x GA/karavi-authorization-example.png similarity index 100% rename from content/docs/authorization/karavi-authorization-example.png rename to content/docs/authorization/v1.x GA/karavi-authorization-example.png diff --git a/content/docs/authorization/release/_index.md b/content/docs/authorization/v1.x GA/release/_index.md similarity index 59% rename from content/docs/authorization/release/_index.md rename to content/docs/authorization/v1.x GA/release/_index.md index 7f187338c5..489a70dbd4 100644 --- a/content/docs/authorization/release/_index.md +++ b/content/docs/authorization/v1.x GA/release/_index.md @@ -6,7 +6,7 @@ Description: > Dell Container Storage Modules (CSM) release notes for authorization --- -## Release Notes - CSM Authorization 1.10.1 +## Release Notes - CSM Authorization 1.11.0 @@ -26,4 +26,3 @@ Description: > ### Known Issues | Issue | Workaround | |-------|------------| -| CSM Operator does not support dynamic namespaces for Authorization. Despite successful installation in a namespace other than "authorization", errors may arise during volume creation. | Use the default namespace "authorization" for installing Authorization using CSM Operator| diff --git a/content/docs/authorization/troubleshooting.md b/content/docs/authorization/v1.x GA/troubleshooting.md similarity index 100% rename from content/docs/authorization/troubleshooting.md rename to content/docs/authorization/v1.x GA/troubleshooting.md diff --git a/content/docs/authorization/v2.0 Tech Preview/_index.md b/content/docs/authorization/v2.0 Tech Preview/_index.md new file mode 100644 index 0000000000..2da76696a7 --- /dev/null +++ b/content/docs/authorization/v2.0 Tech Preview/_index.md @@ -0,0 +1,78 @@ +--- +title: Authorization - v2.0 Tech Preview +linktitle: v2.0 Tech Preview +weight: 4 +Description: > + Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.0 Tech Preview. +tags: + - csm-authorization +--- + +>> NOTE: This tech-preview release is not intended for use in production environment. + +>> NOTE: Only supported on PowerFlex. + +The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator. + +![Alt text](image.png) + +This is the introduction to a Stateless Architecture for Authorization. The creation of storage, roles, and tenants is done through Custom Resources (CRs) which are tracked and contained within CSM Authorization. The underlying communication is consistent with the previous architecture which makes the creation of volumes and snapshots seamless. + +## CSM for Authorization Capabilities +{{}} +| Feature | PowerFlex | PowerMax | PowerScale | +| ----------------------------------------------------------------------------------------------------------------------------- | --------- | -------- | ---------- | +| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | No | No | +| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | No | No | +| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | No | No | +| Ability to create snapshots from owned volumes that consume the storage quota | Yes | No | No | +| Ability to periodically query storage array to keep quota consumption in sync | Yes | No | No | +{{
}} + +### Snapshot Support + +As stated above, all snapshot requests that are associated with a volume that has been approved and created will go through a similar authorization processes ensuring that the snapshot fits within the allotted quota. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshot +metadata: + name: vol1-snapshot +spec: + volumeSnapshotClassName: vxflexos-snapclass + source: + persistentVolumeClaimName: vol1 +``` + +This will take a snapshot of the `persistent volume claim` named `vol1`. CSM Authorization will verify ownership with Redis to ensure that the tenant who is attempting to create the snapshot owns the `vol1` volume. If the tenant does own the volume, authorization will proceed to check to see if the snapshot fits within the allotted quota and add a record if it does. + +### Backend Storage Polling + +A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration/proxy-server/#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync. + +If a volume is created with the matching `volumePrefix`, the new entry will be added to Redis and the available quota will be consumed accordingly. Similarly, if a snapshot is created from a volume that is owned by the tenant in the backend storage array, that will be added to Redis. + +Lastly, if there is any deletion on the backend storage array of a volume or snapshot that is owned by the tenant, that entry will be deleted from Redis and the available capacity will reflect accordingly. + +## Roles and Responsibilities + +The Stateless CSM Authorization contains the following roles: +- Storage Administrators +- Kubernetes Tenant Administrators + +### Storage Administrators + +Storage Administrators perform the following: + +- Storage System Management (create, get, delete) +- Role Management (create, get, delete) +- Tenant Management (create, get, delete) +- Token Management (create, revoke) + +For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.0-tech-preview/configuration/proxy-server/#configuring-storage). + +### Tenant Administrators + +Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests. + +For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.0-tech-preview/configuration/powerflex). \ No newline at end of file diff --git a/content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png b/content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png new file mode 100644 index 0000000000..5b8efc09e4 Binary files /dev/null and b/content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png differ diff --git a/content/docs/authorization/v2.0 Tech Preview/configuration/_index.md b/content/docs/authorization/v2.0 Tech Preview/configuration/_index.md new file mode 100644 index 0000000000..ce03f60cec --- /dev/null +++ b/content/docs/authorization/v2.0 Tech Preview/configuration/_index.md @@ -0,0 +1,8 @@ +--- +title: Configuration +linktitle: Configuration +weight: 2 +description: Configure CSM Authorization +--- + +This section provides the details and instructions on how to configure CSM Authorization. \ No newline at end of file diff --git a/content/docs/authorization/v2.0 Tech Preview/configuration/powerflex/_index.md b/content/docs/authorization/v2.0 Tech Preview/configuration/powerflex/_index.md new file mode 100644 index 0000000000..2cb84ca9b0 --- /dev/null +++ b/content/docs/authorization/v2.0 Tech Preview/configuration/powerflex/_index.md @@ -0,0 +1,119 @@ +--- +title: PowerFlex +linktitle: PowerFlex +description: > + Enabling CSM Authorization for PowerFlex CSI Driver +--- + +## Configuring PowerFlex CSI Driver with CSM for Authorization + +Given a setup where Kubernetes, a storage system, and the CSM for Authorization Proxy Server are deployed, follow these steps to configure the CSI Drivers to work with the Authorization sidecar: + +1. Apply the secret containing the tenant token data into the driver namespace. It's assumed that the Kubernetes administrator has the token secret manifest, generated by your storage administrator via [Generate a Token](../proxy-server/#generate-a-token), saved in `/tmp/token.yaml`. + + ```bash + kubectl apply -f /tmp/token.yaml -n vxflexos + ``` + + This takes the assumption that Powerflex will be installed in the `vxflexos` namespace. + +2. Edit these parameters in `samples/secret/karavi-authorization-config.json` file in the [CSI PowerFlex](https://github.com/dell/csi-powerflex/tree/main/samples) driver and update/add connection information for one or more backend storage arrays. In an instance where multiple CSI drivers are configured on the same Kubernetes cluster, the port range in the *endpoint* parameter must be different for each driver. + + | Parameter | Description | Required | Default | + | --------- | ----------- | -------- |-------- | + | username | Username for connecting to the backend storage array. This parameter is ignored. | No | - | + | password | Password for connecting to to the backend storage array. This parameter is ignored. | No | - | + | intendedEndpoint | HTTPS REST API endpoint of the backend storage array. | Yes | - | + | endpoint | HTTPS localhost endpoint that the authorization sidecar will listen on. | Yes | https://localhost:9400 | + | systemID | System ID of the backend storage array. | Yes | " " | + | skipCertificateValidation | A boolean that enables/disables certificate validation of the backend storage array. This parameter is not used. | No | true | + | isDefault | A boolean that indicates if the array is the default array. This parameter is not used. | No | default value from values.yaml | + + Create the karavi-authorization-config secret using this command: + + ```bash + + kubectl -n vxflexos create secret generic karavi-authorization-config --from-file=config=samples/secret/karavi-authorization-config.json -o yaml --dry-run=client | kubectl apply -f - + ``` + +3. Create the proxy-server-root-certificate secret. + + If running in *insecure* mode, create the secret with empty data: + + ```bash + + kubectl -n vxflexos create secret generic proxy-server-root-certificate --from-literal=rootCertificate.pem= -o yaml --dry-run=client | kubectl apply -f - + ``` + + Otherwise, create the proxy-server-root-certificate secret with the appropriate file: + + ```bash + + kubectl -n vxflexos create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f - + ``` + +4. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with the CSM Authorization sidecar. + + **Operator** + + Refer to the [Create Secret](../../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar. + + - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. + + - Update `skipCertificateValidation` to `true`. + + - The `username` and `password` can be any value since they will be ignored. + + Example: + + ```yaml + - username: "ignored" + password: "ignored" + systemID: "ID2" + endpoint: "https://localhost:9400" + skipCertificateValidation: true + isDefault: true + mdm: "10.0.0.3,10.0.0.4" + ``` + +5. Enable CSM Authorization in the driver installation applicable to your installation method. + + **Operator** + + Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powerflex/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization. + + Under `modules`, enable the module named `authorization`: + + - Update the `enabled` field to `true.` + + - Update the `image` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. + + - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. + + - Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. + + - Do not update the `configVersion`. You will notice in the example that it is set to v1.11.0, this ensures that checks on version support do not prevent deployment of the v2.0.0-alpha authorization tech preview. + + Example: + + ```yaml + modules: + # Authorization: enable csm-authorization for RBAC + - name: authorization + # enable: Enable/Disable csm-authorization + enabled: true + configVersion: v1.11.0 + components: + - name: karavi-authorization-proxy + image: dellemc/csm-authorization-sidecar:v2.0.0-alpha + envs: + # proxyHost: hostname of the csm-authorization server + - name: "PROXY_HOST" + value: "csm-authorization.com" + + # skipCertificateValidation: Enable/Disable certificate validation of the csm-authorization server + - name: "SKIP_CERTIFICATE_VALIDATION" + value: "true" + ``` + +6. Install the Dell CSI PowerFlex driver following the appropriate documenation for your installation method. diff --git a/content/docs/authorization/v2.0 Tech Preview/configuration/proxy-server/_index.md b/content/docs/authorization/v2.0 Tech Preview/configuration/proxy-server/_index.md new file mode 100644 index 0000000000..934dd61d3a --- /dev/null +++ b/content/docs/authorization/v2.0 Tech Preview/configuration/proxy-server/_index.md @@ -0,0 +1,166 @@ +--- +title: Proxy Server +linktitle: Proxy Server +description: > + Configuring the CSM for Authorization Proxy Server +--- + +## Configuring the CSM for Authorization Proxy Server + +Run `kubectl -n authorization get ingress` and `kubectl -n authorization get service` to see the Ingress rules for these services and the exposed port for accessing these services via the LoadBalancer. For example: + +```bash +kubectl -n authorization get ingress +``` +``` +NAME CLASS HOSTS ADDRESS PORTS AGE +proxy-server nginx csm-authorization.com 00, 000 86s +``` +```bash +kubectl -n authorization get service +``` +``` +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +authorization-cert-manager ClusterIP 00.000.000.000 000/TCP 28s +authorization-cert-manager-webhook ClusterIP 00.000.000.000 000/TCP 27s +authorization-ingress-nginx-controller LoadBalancer 00.000.000.000 00:00000/TCP,000:00000/TCP 27s +authorization-ingress-nginx-controller-admission ClusterIP 00.000.000.000 000/TCP 27s +proxy-server ClusterIP 00.000.000.000 000/TCP 28s +redis-csm ClusterIP 00.000.000.000 000/TCP 28s +rediscommander ClusterIP 00.000.000.000 000/TCP 27s +role-service ClusterIP 00.000.000.000 000/TCP 27s +sentinel ClusterIP 00.000.000.000 000/TCP 27s +storage-service ClusterIP 00.000.000.000 000/TCP 27s +tenant-service ClusterIP 00.000.000.000 000/TCP 28s +``` + +On the machine running `dellctl`, if the Ingress host is left default (`csm-authorization.com`) during installation or any of the hostnames don't resolve, the hostnames needs to be add to the `/etc/hosts` file. For example: + +```bash + csm-authorization.com +``` + +Afterwards, the storage administrator can configure Authorization with the following via Customer Resources (CRs): +- Storage systems +- Tenants +- Roles + +### Configuring Storage + +A `storage` entity in CSM Authorization consists of the storage type (PowerFlex), the system ID, the API endpoint, and the vault credentials path. For example, to create PowerFlex storage: + +```yaml +apiVersion: csm-authorization.storage.dell.com/v1alpha1 +kind: Storage +metadata: + name: powerflex +spec: + type: powerflex + endpoint: https://10.0.0.1 + systemID: 1000000000000000 + credentialStore: vault + credentialPath: storage/powerflex + skipCertificateValidation: true + pollInterval: 30s +``` + +>__Note__: +> - The `credentialStore` is the way that credentials for the storage array are stored. +> - The `credentialPath` is the location within the store that the credentials for the array are stored. + +### Configuring Roles + +A `role` consists of a name, the storage array to use, and the quota limit for the storage pool to be used. For example, to create a role named `role1` using the PowerFlex storage created above with a quota limit of 128GB in storage pool `myStoragePool`: + +```yaml +apiVersion: csm-authorization.storage.dell.com/v1alpha1 +kind: CSMRole +metadata: + labels: + app.kubernetes.io/name: role + app.kubernetes.io/instance: role-sample + app.kubernetes.io/part-of: csm-authorization + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/created-by: csm-authorization + name: role1 +spec: + quota: 128GB + systemID: 1000000000000000 + systemType: powerflex + pool: myStoragePool +``` + +>__Note__: +> - The `name` is the name of the role that will be used to bind with the tenant. +> - The `quota` is the amount of allocated space for the specified role. + +### Configuring Tenants + +A `tenant` is a Kubernetes cluster that a role will be bound to. For example, to create a tenant named `csmtenant-sample`: + +```yaml +apiVersion: csm-authorization.storage.dell.com/v1alpha1 +kind: CSMTenant +metadata: + labels: + app.kubernetes.io/name: csmtenant + app.kubernetes.io/instance: csmtenant-sample + app.kubernetes.io/part-of: csm-authorization + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/created-by: csm-authorization + name: csmtenant-sample +spec: + roles: role1 + approveSdc: false + revoke: false + # This prefix is added for each new volume provisioned by the tenant. + # It should not exceed 3 characters. Example: tn1 + volumePrefix: tn1 + +``` + +>__Note__: +> - The `roles` are a comma seperate list of roles that the tenant can be associated with. +> - The `volumePrefix` is the prefix that all volumes and snapshots will contain to show association with the tenant. +> - By creating a tenant, it will automatically bind with the roles for usage. + +### Generate a Token + +Once the tenant is created, an access/refresh token pair can be created for the tenant. The storage admin is responsible for generating and sending the token to the Kubernetes tenant admin. + +Generate an administrator token: + +```bash +dellctl admin token -n --access-token-expiration 1m30s --refresh-token-expiration 720h --jwt-signing-secret > admin.yaml +``` + +You can also pass in the `jwt-signing-secret` via terminal prompt by not supplying the `--jwt-signing-secret` argument: + +```bash +dellctl admin token -n --access-token-expiration 1m30s --refresh-token-expiration 720h > admin.yaml +``` + +```bash + dellctl generate token --admin-token admin.yaml --addr csm-authorization.com: --insecure true --tenant --access-token-expiration 30m0s --refresh-token-expiration 1480h0m0s > token.yaml +``` + +`token.yaml` will have a Kubernetes secret manifest that looks like this: + +```yaml +apiVersion: v1 +data: + access: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SmhkV1FpT2lKamMyMGlMQ0psZUhBaU9qRTNNVFkwTURRd016UXNJbWR5YjNWd0lqb2lZM050ZEdWdVlXNTBMWE5oYlhCc1pTSXNJbWx6Y3lJNkltTnZiUzVrWld4c0xtTnpiU0lzSW5KdmJHVnpJam9pY205c1pURWlMQ0p6ZFdJaU9pSmpjMjB0ZEdWdVlXNTBJbjAuRmtVTGotT01mSW9rN3ZWNmFKQURXR1dva1Bsd1huT2tZeWxSclZjN2F5Zw== + refresh: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SmhkV1FpT2lKamMyMGlMQ0psZUhBaU9qRTNNakUzTXpBeU16UXNJbWR5YjNWd0lqb2lZM050ZEdWdVlXNTBMWE5oYlhCc1pTSXNJbWx6Y3lJNkltTnZiUzVrWld4c0xtTnpiU0lzSW5KdmJHVnpJam9pY205c1pURWlMQ0p6ZFdJaU9pSmpjMjB0ZEdWdVlXNTBJbjAudWRYSFZ3MGg1dTdoTjZaVGJlNHgyYXRMWWhIamQta1ZtTFBVUHpXOHNIaw== +kind: Secret +metadata: + creationTimestamp: null + name: proxy-authz-tokens +type: Opaque +``` + +This secret must be applied in the driver namespace. + +>__Note__: +> - The `insecure` flag specifies to skip certificate validation when connecting to the Authorization proxy-server. +> - The `addr` flag is the address of the Authorization proxy-server. +> - The `tenant` flag specifies which tenant to generate the token for. diff --git a/content/docs/authorization/v2.0 Tech Preview/image.png b/content/docs/authorization/v2.0 Tech Preview/image.png new file mode 100644 index 0000000000..d21d835580 Binary files /dev/null and b/content/docs/authorization/v2.0 Tech Preview/image.png differ diff --git a/content/docs/cosidriver/release/_index.md b/content/docs/cosidriver/release/_index.md index 2fbbebd148..03121d192b 100644 --- a/content/docs/cosidriver/release/_index.md +++ b/content/docs/cosidriver/release/_index.md @@ -5,7 +5,7 @@ weight: 6 description: Release Notes for COSI Driver --- -## Release Notes - COSI Driver v0.2.1 +## Release Notes - COSI Driver v0.3.0 diff --git a/content/docs/csidriver/_index.md b/content/docs/csidriver/_index.md index 3cf82bf341..76ff92a022 100644 --- a/content/docs/csidriver/_index.md +++ b/content/docs/csidriver/_index.md @@ -16,7 +16,7 @@ The CSI Drivers by Dell implement an interface between [CSI](https://kubernetes- {{}} | Features | PowerMax | PowerFlex | Unity XT | PowerScale | PowerStore | |--------------------------|:--------:|:---------:|:---------:|:----------:|:----------:| -| CSI Driver version | 2.10.1 | 2.10.1 | 2.10.1 | 2.10.1 | 2.10.1 | +| CSI Driver version | 2.11.0 | 2.11.0 | 2.11.0 | 2.11.0 | 2.11.0 | | Static Provisioning | yes | yes | yes | yes | yes | | Dynamic Provisioning | yes | yes | yes | yes | yes | | Expand Persistent Volume | yes | yes | yes | yes | yes | @@ -41,7 +41,7 @@ The CSI Drivers by Dell implement an interface between [CSI](https://kubernetes- |---------------|:----------------:|:------------------:|:----------------:|:----------------:|:----------------:| | Fibre Channel | yes | N/A | yes | N/A | yes | | iSCSI | yes | N/A | yes | N/A | yes | -| NVMeTCP | N/A | N/A | N/A | N/A | yes | +| NVMeTCP | yes | N/A | N/A | N/A | yes | | NVMeFC | N/A | N/A | N/A | N/A | yes | | NFS | yes - SDNAS only (not eNAS) | yes | yes | yes | yes | | Other | N/A | ScaleIO protocol | N/A | N/A | N/A | @@ -50,3 +50,4 @@ The CSI Drivers by Dell implement an interface between [CSI](https://kubernetes- | Platform-specific configurable settings | Service Level selection
iSCSI CHAP | - | Host IO Limit
Tiering Policy
NFS Host IO size
Snapshot Retention duration | Access Zone
NFS version (3 or 4);Configurable Export IPs | iSCSI CHAP | | Auto RDM(vSphere) | Yes(over FC) | N/A | N/A | N/A | N/A | {{
}} + diff --git a/content/docs/csidriver/features/powerflex.md b/content/docs/csidriver/features/powerflex.md index 0b2b109c74..c69d6ae7c4 100644 --- a/content/docs/csidriver/features/powerflex.md +++ b/content/docs/csidriver/features/powerflex.md @@ -765,6 +765,9 @@ The user can also set the volume limit for all the nodes in the cluster by speci ## NFS volume support Starting with version 2.8, the CSI driver for PowerFlex will support NFS volumes for PowerFlex storage systems version 4.0.x. +> NOTE: +> Starting from CSM 1.11.0, the CSI-PowerFlex driver will automatically round up NFS volume sizes to a minimum of 3GB if a smaller size is requested. This change prevents backend errors and ensures compatibility. + CSI driver will support following operations for NFS volumes: * Creation and deletion of a NFS volume with RWO/RWX/ROX access modes. diff --git a/content/docs/csidriver/features/powermax.md b/content/docs/csidriver/features/powermax.md index c21e42a153..0cdc4ef70e 100644 --- a/content/docs/csidriver/features/powermax.md +++ b/content/docs/csidriver/features/powermax.md @@ -636,3 +636,13 @@ This feature is also supported for limiting the volume provisioning on Kubernete >**NOTE:**
The default value of `maxPowerMaxVolumesPerNode` is 0.
If `maxPowerMaxVolumesPerNode` is set to zero, then CO shall decide how many volumes of this type can be published by the controller to the node.

The volume limit specified to `maxPowerMaxVolumesPerNode` attribute is applicable to all the nodes in the cluster for which node label `max-powermax-volumes-per-node` is not set.
Supported maximum number of RDM Volumes per VM is 60 as per the limitations.
If the value is set both by node label and values.yaml file then node label value will get the precedence and user has to remove the node label in order to reflect the values.yaml value. +## NVMe/TCP Support + +The CSI Driver for Dell PowerMax supports NVMeTCP from v2.11.0. To enable NVMe/TCP provisioning, blockProtocol in settings file should be specified as NVMETCP. + +**Limitations**
+These are the CSM modules not supported with NVMeTCP protocol: +- CSM Authorization +- CSM Observability +- CSM Application Mobility +- Metro Replication \ No newline at end of file diff --git a/content/docs/csidriver/features/powerscale.md b/content/docs/csidriver/features/powerscale.md index 4169acdc41..f096ee9604 100644 --- a/content/docs/csidriver/features/powerscale.md +++ b/content/docs/csidriver/features/powerscale.md @@ -21,7 +21,7 @@ You can use existing volumes from the PowerScale array as Persistent Volumes in 1. Open your volume in One FS, and take a note of volume-id. 2. Create PersistentVolume and use this volume-id as a volumeHandle in the manifest. Modify other parameters according to your needs. -3. In the following example, the PowerScale cluster accessZone is assumed as 'System', storage class as 'isilon', cluster name as 'pscale-cluster' and volume's internal name as 'isilonvol'. The volume-handle should be in the format of `=_=_==_=_==_=_=` +3. In the following example, the PowerScale cluster accessZone is assumed as 'System', storage class as 'isilon', cluster name as 'pscale-cluster' and volume's internal name as 'isilonvol'. The volume-handle should be in the format of `=_=_==_=_==_=_=` 4. If Quotas are enabled in the driver, it is required to add the Quota ID to the description of the NFS export in this format: `CSI_QUOTA_ID:sC-kAAEAAAAAAAAAAAAAQEpVAAAAAAAA` 5. Quota ID can be identified by querying the PowerScale system. diff --git a/content/docs/csidriver/features/unity.md b/content/docs/csidriver/features/unity.md index aad8844439..80e0c90839 100644 --- a/content/docs/csidriver/features/unity.md +++ b/content/docs/csidriver/features/unity.md @@ -711,3 +711,16 @@ data: TENANT_NAME: "" ``` >Note: csi-unity supports Tenancy in multi-array setup, provided the TenantName is the same across Unity XT instances. + +## Support custom networks for NFS I/O traffic + +When `allowedNetworks` is specified for using custom networks to handle NFS traffic, and a user already +has workloads scheduled, there is a possibility that it might lead to backward compatibility issues. For example, ControllerUnPublish might not be able to completely remove clients from the NFS exports of previously created pods. + +Also, the previous workload will still be using the default network and not custom networks. For previous workloads to use custom networks, the recreation of pods is required. + +When csi-unity driver creates an NFS export, the traffic flows through the client specified in the export. By default, the client is the network interface for Kubernetes +communication (same IP/fqdn as k8s node) by default. + +For a cluster with multiple network interfaces and if a user wants to segregate k8s traffic from NFS traffic; you can use the `allowedNetworks` option. +`allowedNetworks` takes CIDR addresses as a parameter to match the IPs to be picked up by the driver to allow and route NFS traffic. diff --git a/content/docs/csidriver/release/powerflex.md b/content/docs/csidriver/release/powerflex.md index 1a86c13149..f691061338 100644 --- a/content/docs/csidriver/release/powerflex.md +++ b/content/docs/csidriver/release/powerflex.md @@ -3,7 +3,7 @@ title: PowerFlex description: Release notes for PowerFlex CSI driver --- -## Release Notes - CSI PowerFlex v2.10.1 +## Release Notes - CSI PowerFlex v2.11.0 @@ -40,9 +40,10 @@ A CSI ephemeral pod may not get created in OpenShift 4.13 and fail with the erro | If the volume limit is exhausted and there are pending pods and PVCs due to `exceed max volume count`, the pending PVCs will be bound to PVs and the pending pods will be scheduled to nodes when the driver pods are restarted. | It is advised not to have any pending pods or PVCs once the volume limit per node is exhausted on a CSI Driver. There is an open issue reported with kubenetes at https://github.com/kubernetes/kubernetes/issues/95911 with the same behavior. | | The PowerFlex Dockerfile is incorrectly labeling the version as 2.7.0 for the 2.8.0 version. | Describe the driver pod using ```kubectl describe pod $podname -n vxflexos``` to ensure v2.8.0 is installed. | | Resource quotas may not work properly with the CSI PowerFlex driver. PowerFlex is only able to assign storage in 8Gi chunks, so if a create volume call is made with a size not divisible by 8Gi, CSI-PowerFlex will round up to the next 8Gi boundary when it provisions storage -- however, the resource quota will not record this size but rather the original size in the create request. This means that, for example, if a 10Gi resource quota is set, and a user provisions 10 1Gi PVCs, 80Gi of storage will actually be allocated, which is well over the amount specified in the resource quota. | For now, users should only provision volumes in 8Gi-divisible chunks if they want to use resource quotas. | +| Helm install of CSM for PowerFlex v1.10.0 is failing due to a duplicate `mountPath: /host_opt_emc_path` being added to volumeMounts charts/csi-vxflexos/templates/node.yaml. Error message is `Error: INSTALLATION FAILED: 1 error occurred: DaemonSet.apps "vxflexos-node" is invalid: spec.template.spec.initContainers[0].volumeMounts[4].mountPath: Invalid value: "/host_opt_emc_path": must be unique` | The issue can be resolved by removing the duplicate entry in [https://github.com/dell/helm-charts/blob/main/charts/csi-vxflexos/templates/node.yaml](https://github.com/dell/helm-charts/blob/main/charts/csi-vxflexos/templates/node.yaml) | ### Note: -- Support for Kubernetes alpha features like Volume Health Monitoring and RWOP (ReadWriteOncePod) access mode will not be available in Openshift environment as Openshift doesn't support enabling of alpha features for Production Grade clusters. -- For fixing [#1210 - [BUG]: Helm deployment of PowerFlex driver is failing](https://github.com/dell/csm/issues/1210), a new helm-chart has been released. In order to install this helm chart, we need to pass the flag `--helm-charts-version` during helm installation and flag `-v` during offline bundle installation with value `csi-vxflexos-2.10.1`. +- Support for Kubernetes alpha features like Volume Health Monitoring will not be available in Openshift environment as Openshift doesn't support enabling of alpha features for Production Grade clusters. +- For fixing [#1210 - [BUG]: Helm deployment of PowerFlex driver is failing](https://github.com/dell/csm/issues/1210), a new helm-chart has been released. In order to install this helm chart, we need to pass the flag `--helm-charts-version` during helm installation and flag `-v` during offline bundle installation with value `csi-vxflexos-2.11.0`. diff --git a/content/docs/csidriver/release/powermax.md b/content/docs/csidriver/release/powermax.md index 06b51d08c7..d8aab8f729 100644 --- a/content/docs/csidriver/release/powermax.md +++ b/content/docs/csidriver/release/powermax.md @@ -3,7 +3,7 @@ title: PowerMax description: Release notes for PowerMax CSI driver --- -## Release Notes - CSI PowerMax v2.10.1 +## Release Notes - CSI PowerMax v2.11.0 >Note: Auto SRDF group creation is currently not supported in PowerMaxOS 10.1 (6079) Arrays. diff --git a/content/docs/csidriver/release/powerscale.md b/content/docs/csidriver/release/powerscale.md index c2fdff0399..2e68996e7a 100644 --- a/content/docs/csidriver/release/powerscale.md +++ b/content/docs/csidriver/release/powerscale.md @@ -4,7 +4,7 @@ description: Release notes for PowerScale CSI driver --- -## Release Notes - CSI Driver for PowerScale v2.10.1 +## Release Notes - CSI Driver for PowerScale v2.11.0 diff --git a/content/docs/csidriver/release/powerstore.md b/content/docs/csidriver/release/powerstore.md index a6faeca3db..9000b48db0 100644 --- a/content/docs/csidriver/release/powerstore.md +++ b/content/docs/csidriver/release/powerstore.md @@ -3,7 +3,7 @@ title: PowerStore description: Release notes for PowerStore CSI driver --- -## Release Notes - CSI PowerStore v2.10.1 +## Release Notes - CSI PowerStore v2.11.0 @@ -29,6 +29,18 @@ description: Release notes for PowerStore CSI driver ### Known Issues +| Issue | Resolution or workaround, if known | +|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Delete namespace that has PVCs and pods created with the driver. The External health monitor sidecar crashes as a result of this operation | Deleting the namespace deletes the PVCs first and then removes the pods in the namespace. This brings a condition where pods exist without their PVCs and causes the external-health-monitor sidecar to crash. This is a known issue and has been reported at https://github.com/kubernetes-csi/external-health-monitor/issues/100
| +| fsGroupPolicy may not work as expected without root privileges for NFS only
https://github.com/kubernetes/examples/issues/260 | To get the desired behavior set "allowRoot: "true" in the storage class parameter | +| If the NVMeFC pod is not getting created and the host looses the ssh connection, causing the driver pods to go to error state | remove the nvme_tcp module from the host incase of NVMeFC connection | +| When a node goes down, the block volumes attached to the node cannot be attached to another node | This is a known issue and has been reported at https://github.com/kubernetes-csi/external-attacher/issues/215. Workaround:
1. Force delete the pod running on the node that went down
2. Delete the volumeattachment to the node that went down.
Now the volume can be attached to the new node. | +| When driver node pods enter CrashLoopBackOff and PVC remains in pending state with one of the following events:
1. failed to provision volume with StorageClass ``: error generating accessibility requirements: no available topology found
2. waiting for a volume to be created, either by external provisioner "csi-powerstore.dellemc.com" or manually created by system administrator. | Check whether all array details present in the secret file are valid and remove any invalid entries if present.
Redeploy the driver. | +| If an ephemeral pod is not being created in OpenShift 4.13 and is failing with the error "error when creating pod: the pod uses an inline volume provided by CSIDriver csi-powerstore.dellemc.com, and the namespace has a pod security enforcement level that is lower than privileged." | This issue occurs because OpenShift 4.13 introduced the CSI Volume Admission plugin to restrict the use of a CSI driver capable of provisioning CSI ephemeral volumes during pod admission https://docs.openshift.com/container-platform/4.13/storage/container_storage_interface/ephemeral-storage-csi-inline.html . Therefore, an additional label "security.openshift.io/csi-ephemeral-volume-profile" needs to be added to the CSIDriver object to support inline ephemeral volumes. | +| In OpenShift 4.13, the root user is not allowed to perform write operations on NFS shares, when root squashing is enabled. | The workaround for this issue is to disable root squashing by setting allowRoot: "true" in the NFS storage class. | +| If the volume limit is exhausted and there are pending pods and PVCs due to `exceed max volume count`, the pending PVCs will be bound to PVs, and the pending pods will be scheduled to nodes when the driver pods are restarted. | It is advised not to have any pending pods or PVCs once the volume limit per node is exhausted on a CSI Driver. There is an open issue reported with Kubenetes at https://github.com/kubernetes/kubernetes/issues/95911 with the same behavior. | +| If two separate networks are configured for ISCSI and NVMeTCP, the driver may encounter difficulty identifying the second network (e.g., NVMeTCP). | This is a known issue, and the workaround involves creating a single network on the array to serve both ISCSI and NVMeTCP purposes. | +| When a PV/PVC is deleted in Kubernetes, it will trigger the deletion of the underlying volume and snapshot on the array as a default behaviour. This can result in a situation where the VolumeSnapshot and VolumeSnapshotContent will still show "readyToUse: true", but leaves them unusable because it is no longer backed by underlying storage snapshot. This will not allow the creation of a PVC from snapshot and this could also lead to a data loss situations. | This is a known issue, and the workaround is use of **retain** policy on the various PV, VolumeSnapshot and VolumeSnapshotContent that you wish to use for cloning. | | Issue | Resolution or workaround, if known | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Delete namespace that has PVCs and pods created with the driver. The External health monitor sidecar crashes as a result of this operation | Deleting the namespace deletes the PVCs first and then removes the pods in the namespace. This brings a condition where pods exist without their PVCs and causes the external-health-monitor sidecar to crash. This is a known issue and has been reported at https://github.com/kubernetes-csi/external-health-monitor/issues/100
| @@ -44,4 +56,4 @@ description: Release notes for PowerStore CSI driver ### Note: -- Support for Kubernetes alpha features like Volume Health Monitoring will not be available in Openshift environment as Openshift doesn't support enabling of alpha features for Production Grade clusters. +- Support for Kubernetes alpha features like Volume Health Monitoring will not be available in Openshift environment as Openshift doesn't support enabling of alpha features for Production Grade clusters. \ No newline at end of file diff --git a/content/docs/csidriver/release/unity.md b/content/docs/csidriver/release/unity.md index 2d775e9939..ceecaff333 100644 --- a/content/docs/csidriver/release/unity.md +++ b/content/docs/csidriver/release/unity.md @@ -3,7 +3,7 @@ title: Unity XT description: Release notes for Unity XT CSI driver --- -## Release Notes - CSI Unity XT v2.10.1 +## Release Notes - CSI Unity XT v2.11.0 diff --git a/content/docs/csidriver/troubleshooting/powerflex.md b/content/docs/csidriver/troubleshooting/powerflex.md index e4c8f0dcf2..11b7af93f3 100644 --- a/content/docs/csidriver/troubleshooting/powerflex.md +++ b/content/docs/csidriver/troubleshooting/powerflex.md @@ -6,6 +6,7 @@ description: Troubleshooting PowerFlex Driver | Symptoms | Prevention, Resolution or Workaround | |------------|--------------| +| After installation vxflexos-node pods are in an `Init:CrashLoopBackOff` state in OpenShift 4.16 with error message: ```Back-off restarting failed container sdc in pod vxflexos-node``` on non-supported kernel versions. | Use SDC version 4.5.2.1 in OpenShift 4.16. | | The installation fails with the following error message:
```Node xxx does not have the SDC installed```| Install the PowerFlex SDC on listed nodes. The SDC must be installed on all the nodes that need to pull an image of the driver. | | When you run the command `kubectl describe pods vxflexos-controller-* –n vxflexos`, the system indicates that the driver image could not be loaded. | - If on Kubernetes, edit the `daemon.json` file found in the registry location and add
```{ "insecure-registries" :[ "hostname.cloudapp.net:5000" ] }```
- If on OpenShift, run the command `oc edit image.config.openshift.io/cluster` and add registries to yaml file that is displayed when you run the command. | |The `kubectl logs -n vxflexos vxflexos-controller-* driver` logs show that the driver is not authenticated.| Check the username, password, and the gateway IP address for the PowerFlex system.| @@ -30,6 +31,7 @@ description: Troubleshooting PowerFlex Driver | In version v2.6.0, when a cluster node goes down, the block volumes attached to the node cannot be attached to another node. | This is a known issue reported at [kubernetes-csi/external-attacher#215](https://github.com/kubernetes-csi/external-attacher/issues/215). Workaround:
1. Force delete the pod running on the node that went down.
2. Delete the pod's persistent volume attachment on the node that went down. Now the volume can be attached to the new node. A CSI ephemeral pod may not get created in OpenShift 4.13 and fail with the error `"error when creating pod: the pod uses an inline volume provided by CSIDriver csi-vxflexos.dellemc.com, and the namespace has a pod security enforcement level that is lower than privileged."` | This issue occurs because OpenShift 4.13 introduced the CSI Volume Admission plugin to restrict the use of a CSI driver capable of provisioning CSI ephemeral volumes during pod admission. Therefore, an additional label `security.openshift.io/csi-ephemeral-volume-profile` in [csidriver.yaml](https://github.com/dell/helm-charts/blob/csi-vxflexos-2.8.0/charts/csi-vxflexos/templates/csidriver.yaml) file with the required security profile value should be provided. Follow [OpenShift 4.13 documentation for CSI Ephemeral Volumes](https://docs.openshift.com/container-platform/4.13/storage/container_storage_interface/ephemeral-storage-csi-inline.html) for more information. | | Standby controller pod is in crashloopbackoff state | Scale down the replica count of the controller pod's deployment to 1 using ```kubectl scale deployment --replicas=1 -n ``` | +|CSM object `vxflexos` is in falied state and CSI-Powerflex driver is not in running state | Verify the secret name: `kubectl get secret -n ` it should be in `-config` format. 1. Retrieve the existing secret: `kubectl get secret old-secret-name -n -o yaml > secret.yaml`
2. Edit the secret.yaml file: Change metadata.name to -Config
3. Apply the new secret: `kubectl apply -f secret.yaml`
4. Delete the old secret: kubectl delete secret old-secret-name| > diff --git a/content/docs/deployment/csminstallationwizard/_index.md b/content/docs/deployment/csminstallationwizard/_index.md index da7efea482..c1ffbbeb58 100644 --- a/content/docs/deployment/csminstallationwizard/_index.md +++ b/content/docs/deployment/csminstallationwizard/_index.md @@ -13,26 +13,26 @@ The [Dell Container Storage Modules Installation Wizard](./src/index.html) is a | CSI Driver | Version | Helm | Operator | | ------------------ | --------- | ------ | --------- | +| CSI PowerStore | 2.11.0 |✔ |✔ | | CSI PowerStore | 2.10.1 |✔ |✔ | | CSI PowerStore | 2.9.0 |✔ |✔ | | CSI PowerStore | 2.8.0 |✔ |✔ | -| CSI PowerStore | 2.7.0 |✔ |✔ | +| CSI PowerMax | 2.11.0 |✔ |✔ | | CSI PowerMax | 2.10.1 |✔ |✔ | | CSI PowerMax | 2.9.0 |✔ |✔ | | CSI PowerMax | 2.8.0 |✔ |✔ | -| CSI PowerMax | 2.8.0 |✔ |✔ | +| CSI PowerFlex | 2.11.0 |✔ |❌ | | CSI PowerFlex | 2.10.1 |✔ |❌ | -| CSI PowerFlex | 2.9.0 |✔ |❌ | +| CSI PowerFlex | 2.9.0 |✔ |❌ | | CSI PowerFlex | 2.8.0 |✔ |❌ | -| CSI PowerFlex | 2.7.0 |✔ |❌ | +| CSI PowerScale | 2.11.0 |✔ |✔ | | CSI PowerScale | 2.10.1 |✔ |✔ | -| CSI PowerScale | 2.9.0 |✔ |✔ | +| CSI PowerScale | 2.9.0 |✔ |✔ | | CSI PowerScale | 2.8.0 |✔ |✔ | -| CSI PowerScale | 2.7.0 |✔ |✔ | +| CSI Unity XT | 2.11.0 |✔ |❌ | | CSI Unity XT | 2.10.1 |✔ |❌ | -| CSI Unity XT | 2.9.0 |✔ |❌ | +| CSI Unity XT | 2.9.0 |✔ |❌ | | CSI Unity XT | 2.8.0 |✔ |❌ | -| CSI Unity XT | 2.7.0 |✔ |❌ | >NOTE: The Installation Wizard currently does not support operator-based manifest file generation for Unity XT and PowerFlex drivers. diff --git a/content/docs/deployment/csminstallationwizard/release/_index.md b/content/docs/deployment/csminstallationwizard/release/_index.md index b78a9f9b7d..e3501247e6 100644 --- a/content/docs/deployment/csminstallationwizard/release/_index.md +++ b/content/docs/deployment/csminstallationwizard/release/_index.md @@ -5,7 +5,7 @@ weight: 5 description: Release notes for CSM Installation Wizard --- -## Release Notes - CSM Installation Wizard 1.2.1 +## Release Notes - CSM Installation Wizard 1.3.0 diff --git a/content/docs/deployment/csminstallationwizard/src/csm-versions/default-values.properties b/content/docs/deployment/csminstallationwizard/src/csm-versions/default-values.properties index 2ba042bb0e..7ec130a487 100644 --- a/content/docs/deployment/csminstallationwizard/src/csm-versions/default-values.properties +++ b/content/docs/deployment/csminstallationwizard/src/csm-versions/default-values.properties @@ -1,4 +1,4 @@ -csmVersion=1.10.2 +csmVersion=1.11.0 imageRepository=dellemc controllerCount=1 nodeSelectorLabel=node-role.kubernetes.io/control-plane: diff --git a/content/docs/deployment/csminstallationwizard/src/index.html b/content/docs/deployment/csminstallationwizard/src/index.html index 18d70b9368..df2597bfd4 100644 --- a/content/docs/deployment/csminstallationwizard/src/index.html +++ b/content/docs/deployment/csminstallationwizard/src/index.html @@ -90,10 +90,10 @@
diff --git a/content/docs/deployment/csminstallationwizard/src/static/js/constants.js b/content/docs/deployment/csminstallationwizard/src/static/js/constants.js index 7392ed8e73..c11ae18901 100644 --- a/content/docs/deployment/csminstallationwizard/src/static/js/constants.js +++ b/content/docs/deployment/csminstallationwizard/src/static/js/constants.js @@ -40,10 +40,10 @@ const CONSTANTS = { PROPERTIES: ".properties", HELM: "helm", OPERATOR: "operator", - CSM_HELM_V170: "1.0.0", CSM_HELM_V180: "1.1.0", - CSM_HELM_V190: "1.2.1", + CSM_HELM_V190: "1.2.2", CSM_HELM_V1102: "1.3.2", + CSM_HELM_V1110: "1.4.0", HELM_TAINTS: ` - key: "$KEY" operator: "Exists" diff --git a/content/docs/deployment/csminstallationwizard/src/static/js/tests/generate-yaml.test.js b/content/docs/deployment/csminstallationwizard/src/static/js/tests/generate-yaml.test.js index d3f86ca24f..44164efc64 100644 --- a/content/docs/deployment/csminstallationwizard/src/static/js/tests/generate-yaml.test.js +++ b/content/docs/deployment/csminstallationwizard/src/static/js/tests/generate-yaml.test.js @@ -42,10 +42,10 @@ const CONSTANTS = { PROPERTIES: ".properties", HELM: "helm", OPERATOR: "operator", - CSM_HELM_V170: "1.0.0", CSM_HELM_V180: "1.1.0", - CSM_HELM_V190: "1.2.0", - CSM_HELM_V1100: "1.3.0", + CSM_HELM_V190: "1.2.2", + CSM_HELM_V1102: "1.3.2", + CSM_HELM_V1110: "1.4.0", HELM_TAINTS: ` - key: "$KEY" operator: "Exists" diff --git a/content/docs/deployment/csminstallationwizard/src/static/js/tests/ui-functions.test.js b/content/docs/deployment/csminstallationwizard/src/static/js/tests/ui-functions.test.js index eb6e90a452..eabffe7843 100644 --- a/content/docs/deployment/csminstallationwizard/src/static/js/tests/ui-functions.test.js +++ b/content/docs/deployment/csminstallationwizard/src/static/js/tests/ui-functions.test.js @@ -68,10 +68,10 @@ const CONSTANTS = { PROPERTIES: ".properties", HELM: "helm", OPERATOR: "operator", - CSM_HELM_V170: "1.0.0", CSM_HELM_V180: "1.1.0", - CSM_HELM_V190: "1.2.0", - CSM_HELM_V1100: "1.3.0", + CSM_HELM_V190: "1.2.2", + CSM_HELM_V1102: "1.3.2", + CSM_HELM_V1110: "1.4.0", }; describe("GIVEN onAuthorizationChange function", () => { @@ -257,18 +257,22 @@ describe("GIVEN onTopologyChange function", () => { document.body.innerHTML = `
+
`; onCertManagerChange("Temp topology note"); expect($("div#topology-note-wrapper").css("display")).toEqual("block"); + expect($("div#observability-operator-topology-wrapper").css("display")).toEqual("block"); }); test("SHOULD show topology components when option checked", () => { document.body.innerHTML = `