发布日期: 2025-04-16
版本号: v1.17.0

这是 Rook 升级至新版本的重要变更说明。在升级前，请参考官方升级指南。主要的破坏性变更包括：Kubernetes 最低版本要求提升至 v1.28；ObjectBucketClaim 的部分配置选项现默认禁用以确保安全，需通过环境变量启用；CephObjectStoreUser 资源现在支持多凭证管理，可能导致现有未声明的凭证被清理；Kafka 通知默认认证机制变更为 PLAIN。新功能方面，支持将现有 RGW 用户设为桶所有者，Ceph CSI 升级至 3.14 版本，引入了用于双数据中心集群的外部监视器（实验性功能），支持通过 DNS 动态解析监视器端点，并允许为单个节点自定义 ceph.conf 配置。

更新内容 （中文）

升级指南

要从之前的 Rook 版本升级，请参阅 Rook 升级指南。

破坏性变更

  • Rook 目前支持的 Kubernetes 最低版本为 v1.28，并将持续支持到即将发布的 Kubernetes v1.33。
  • 之前在 Rook v1.16 中添加的多个 ObjectBucketClaim 选项提供了对存储桶的更多控制，允许用户自行管理 S3 策略。管理员可能会认为这种灵活性存在风险（具体取决于其环境）。Rook 现在默认禁用这些选项，以确保最安全的开箱即用配置。要启用所有 OBC 配置选项，必须设置新选项 ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS 以允许用户设置这些选项。更多详情请参阅 OBC additionalConfig 文档。
  • CephObjectStoreUser 资源新增了原生凭证管理功能，允许多个凭证和声明式凭证轮换。更多详情请参阅管理用户 S3 凭证。因此，通过 CephObjectStoreUser 资源配置的现有 S3 用户将不再允许多个凭证存在于底层 S3 用户中，除非由 Rook 显式管理。Rook 将清除所有未声明的凭证，仅保留一个。对于曾手动编辑/轮换 CephObjectStoreUsers 的 S3 用户凭证的管理员来说，这可能会导致用户可观察到的回退，受影响的用户可以使用新的凭证管理功能作为替代方案。
  • 通过 CephBucketTopic 资源配置的 Kafka 通知现在默认将 Kafka 认证机制设置为 PLAIN。之前默认未指定认证机制。可以通过 CephBucketTopic.spec.endpoint.kafka.opaqueData 设置认证机制。但是，现在无法再通过 opaqueData 设置 &mechanism=<auth type>。如果使用了 PLAIN 以外的任何认证机制，则需要修改 CephBucketTopic 资源。

新功能

  • 可以将现有 Ceph RGW 用户账户的名称设置为 ObjectBucketClaim (OBC) 的存储桶所有者，而不是为每个存储桶创建一个唯一的 RGW 用户。可以使用 CephObjectStoreUser 资源创建将在 OBC 上指定的 Ceph RGW 用户账户。如果为已被不同用户拥有的现有存储桶设置存储桶所有者，该存储桶将重新链接到指定的用户。
  • Ceph CSI 3.14 版本为 RBD 和 CephFS 卷、卷快照以及许多其他领域提供了多项功能和改进。更多详情请参阅 Ceph CSI 3.14 版本说明。
  • 外部监控器：在某些双数据中心集群中，无法在独立的 K8s 节点上启动仲裁监控器来配置正确的拉伸集群。现在，外部监控器允许在 Kubernetes 集群外配置监控器，而 Rook 管理集群内的所有其他内容。更多详情请参阅外部监控器文档。此功能目前处于实验模式。
  • 监控器 DNS 解析：允许 K8s 集群外的客户端通过 DNS 解析监控器端点，无需手动更新监控器端点列表。这有助于处理虚拟机实时迁移等场景。Ceph 客户端可以连接到 rook-ceph-active-mons..svc.cluster.local 以动态解析监控器端点，并在监控器 IP 更改时自动接收更新。要配置此 DNS 解析，请参阅跟踪监控器端点。
  • 节点特定的 ceph.conf 覆盖：ceph.conf 覆盖现在可以按节点自定义。这可能有助于某些需要根据硬件在每个节点上唯一设置的 ceph.conf 设置。可以通过创建节点特定的 configmap 来配置此功能，该 configmap 将为该节点上的所有 OSD 和 OSD 准备作业加载，而不是从 rook-config-override configmap 加载默认设置。

更新内容 （原始）

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

  • Kubernetes v1.28 is now the minimum version supported by Rook through the soon-to-be K8s release v1.33.
  • Several ObjectBucketClaim options were added previously in Rook v1.16 that allowed more control over buckets. These controls allow users to self-serve their own S3 policies. Administrators may consider this flexibility a risk, depending on their environment. Rook now disables these options by default to ensure the safest off-the-shelf configurations. To enable the full range of OBC configurations, the new setting ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS must be set to enable users to set all of these options. For more details, see the OBC additionalConfig documentation.
  • First-class credential management added to CephObjectStoreUser resources, allowing multiple credentials and declarative credential rotation. For more details, see Managing User S3 Credentials. As a result, existing S3 users provisioned via CephObjectStoreUser resources no longer allow multiple credentials to exist on underlying S3 users, unless explicitly managed by Rook. Rook will purge all but one of the undeclared credentials. This could be a user observable regression for administrators who manually edited/rotated S3 user credentials for CephObjectStoreUsers, and affected users can make use of the new credential management feature as an alternative.
  • Kafka notifications configured via CephBucketTopic resources will now default to setting the Kafka authentication mechanism to PLAIN. Previously, no auth mechanism was specified by default. It was possible to set the auth mechanism via CephBucketTopic.spec.endpoint.kafka.opaqueData. However, setting &mechanism=<auth type> via opaqueData is no longer possible. If any auth mechanism other than PLAIN is in use, modification to CephBucketTopic resources is required.

Features

  • The name of a pre-existing Ceph RGW user account can be set as the bucket owner on an ObjectBucketClaim (OBC), rather than a unique RGW user being created for every bucket. A CephObjectStoreUser resource may be used to create the Ceph RGW user account which will be specified on the OBC. If the bucket owner is set on a bucket that already exists and is owned by a different user, the bucket will be re-linked to the specified user.
  • The Ceph CSI 3.14 release has a number of features and improvements for RBD and CephFS volumes, volume snapshots, and many more areas. See the Ceph CSI 3.14 release notes for more details.
  • External mons: In some two-datacenter clusters, there is no option to start an arbiter mon in an independent K8s node to configure a proper stretch cluster. The external mons now allow a mon to be configured outside the Kubernetes cluster, while Rook manages everything else inside the cluster. For more details, see the External Mon documentation. This feature is in currently in experimental mode.
  • DNS resolution for mons: Allows clients outside the K8s cluster to resolve mon endpoints via DNS without requiring manual updates to the list of mon endpoints. This helps in scenarios such as virtual machine live migration. The Ceph client can connect to rook-ceph-active-mons..svc.cluster.local to dynamically resolve mon endpoints and receive automatic updates when mon IPs change. To configure this DNS resolution, see Tracking Mon Endpoints.
  • Node-specific ceph.conf overrides: The ceph.conf overrides can now be customized per-node. This may be helpful for some ceph.conf settings that need to be unique per node depending on the hardware. This can be configured by creating a node-specific configmap that will be loaded for all OSDs and OSD prepare jobs on that node, instead of the default settings that are loaded from the rook-config-override configmap.

下载链接