Ceph CSI Operator module (shturval-ceph-csi)
About the service
| Parameter | Description |
|---|---|
| GUI name | Ceph CSI Operator module — CephFS/RBD drivers managed through CRDs |
| System name (identifier) | shturval-ceph-csi |
| Cluster assignment | Manage CephFS and RBD drivers through CRDs. The NFS driver is enabled in custom values. |
| Critical | No |
| Default mode | absent |
| Public repository | ceph-csi-operator |
| Dependencies | shturval-ceph-csi-crds, shturval-networking |
| Namespace | ceph-csi-operator |
CRDs are installed by a separate service, shturval-ceph-csi-crds (GUI name: CRDs for the Ceph CSI Operator module (csi.ceph.io)), in the same namespace ceph-csi-operator.
Purpose
shturval-ceph-csi is the Ceph CSI Operator module. It mounts CephFS volumes and Ceph RBD block volumes as PersistentVolumes on request through a StorageClass. It is for file and block storage on Ceph.
By default, an update to 2.15.0 migrates shturval-ceph-cephfs and shturval-ceph-rbd to this service. If you need to, you can run the migration manually before the update starts — see the instructions. Existing volumes keep working.
Where to configure
Services and repositories → Installed services → shturval-ceph-csi → Manage.
Setting up storage classes: StorageClasses. Ceph connection parameters (monitors, secrets with keys, storage classes) are set in customvalues.
Installation and configuration
To work, shturval-networking and shturval-ceph-csi-crds must be running in the cluster. The namespace of both services is ceph-csi-operator. Turn on shturval-ceph-csi-crds first, then shturval-ceph-csi.
If the Ceph CSI modules were already running in the cluster, an update to 2.15.0 usually needs no manual configuration. To enable the module in an already created cluster, use Services and repositories → Installed services or install the shturval-ceph-csi-crds and shturval-ceph-csi charts from Available charts.
If you need to redefine chart parameters, apply the changes via ShturvalServicePatch (SSP).
An existing StorageClass does not accept changes to driver, parameters, clusterID, secretName, or volumeBindingMode: the save fails and the class stays as it is. reclaimPolicy, allowVolumeExpansion, and mountOptions are updated.
CephConnection, ClientProfile, Secret, and Driver with the same names are updated in place. The profile name is the class clusterID and stays unchanged.
Helm deletes an object that is removed from the specification or saved under a new name. The class and existing PVCs keep the old names. A driver that is turned off is removed, and its volumes are not mounted again.
In Service specifications specify customvalues:
Customvalues example
csi:
drivers:
cephfs:
enabled: true
rbd:
enabled: true
nfs:
enabled: true
clusters:
- name: ceph-connection
monitors:
- "<monitor-1>:6789"
- "<monitor-2>:6789"
- "<monitor-3>:6789"
clientProfiles:
- name: <ceph-cluster-fsid>
cephFs:
subVolumeGroup: csi
rbd: {}
nfs: {}
secrets:
- name: csi-cephfs-secret
userID: csi-cephfs
userKey: <cephfs-user-key>
- name: csi-rbd-secret
userID: csi-rbd
userKey: <rbd-user-key>
- name: csi-nfs-secret
userID: csi-nfs
userKey: <nfs-user-key>
storageClasses:
- name: shturval-cephfs
driver: cephfs
clusterID: <ceph-cluster-fsid>
secretName: csi-cephfs-secret
reclaimPolicy: Delete
parameters:
fsName: <filesystem-name>
- name: shturval-rbd
driver: rbd
clusterID: <ceph-cluster-fsid>
secretName: csi-rbd-secret
reclaimPolicy: Delete
allowVolumeExpansion: true
parameters:
pool: <pool-name>
imageFeatures: layering
- name: shturval-nfs
driver: nfs
clusterID: <ceph-cluster-fsid>
secretName: csi-nfs-secret
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: Immediate
mountOptions:
- nfsvers=4.1
- port=2049
parameters:
fsName: <filesystem-name>
nfsCluster: <nfs-cluster-name>
server: "<nfs-server-address>"
| Parameter | Description | Example |
|---|---|---|
csi.drivers.cephfs.enabled | Create the CephFS driver (cephfs.csi.ceph.com) and the driver ServiceAccount | true |
csi.drivers.rbd.enabled | Create the RBD driver (rbd.csi.ceph.com) and the driver ServiceAccount | true |
csi.drivers.nfs.enabled | Create the NFS driver (nfs.csi.ceph.com) and the driver ServiceAccount | true |
csi.clusters[].name | Name of the CephConnection resource | ceph-connection |
csi.clusters[].monitors | Ceph monitor addresses, host:port | <monitor-1>:6789 |
csi.clusters[].clientProfiles[].name | ClientProfile name. Use the same value as the storage class clusterID. Usually the FSID | <ceph-cluster-fsid> |
csi.clusters[].clientProfiles[].cephFs.subVolumeGroup | CephFS subvolume group for dynamic volumes | csi |
csi.clusters[].clientProfiles[].rbd | An empty object enables block volumes on this profile | {} |
csi.clusters[].clientProfiles[].nfs | An empty object enables NFS on this profile | {} |
csi.clusters[].secrets[].name | Secret name in the ceph-csi-operator namespace | csi-cephfs-secret |
csi.clusters[].secrets[].userID | Ceph user, without the client. prefix | csi-cephfs |
csi.clusters[].secrets[].userKey | Key of that user | <cephfs-user-key> |
csi.storageClasses[].name | StorageClass name | shturval-cephfs |
csi.storageClasses[].driver | Short driver name: cephfs, rbd, or nfs | nfs |
csi.storageClasses[].clusterID | Matches clientProfiles[].name | <ceph-cluster-fsid> |
csi.storageClasses[].secretName | Secret name from csi.clusters[].secrets | csi-nfs-secret |
csi.storageClasses[].reclaimPolicy | What happens to the volume when the PVC is deleted: Delete or Retain | Delete |
csi.storageClasses[].allowVolumeExpansion | Allow the volume to grow | true |
csi.storageClasses[].volumeBindingMode | When to bind the volume: Immediate or WaitForFirstConsumer | Immediate |
csi.storageClasses[].mountOptions | NFS volume mount options | nfsvers=4.1 |
csi.storageClasses[].parameters.fsName | CephFS filesystem name. Set it for the cephfs and nfs classes | <filesystem-name> |
csi.storageClasses[].parameters.pool | RBD pool for dynamic volumes | <pool-name> |
csi.storageClasses[].parameters.imageFeatures | RBD image features. layering is required to clone a volume and take a snapshot | layering |
csi.storageClasses[].parameters.nfsCluster | NFS cluster name | <nfs-cluster-name> |
csi.storageClasses[].parameters.server | NFS server address | <nfs-server-address> |
Before you set shturval-ceph-csi to Off (Absent), delete the PVCs that use Ceph storage classes. After the SSC finishes, the ceph-csi-operator namespace should have no ClientProfile left.
Service account permissions
Minimum Ceph user permissions for CephFS (client.csi-cephfs):
mon 'allow r'
mgr 'allow rw'
mds 'allow rws'
osd 'allow rw pool=cephfs_data, allow rw pool=cephfs_metadata'
Minimum permissions for RBD (client.csi-rbd):
mon 'profile rbd'
osd 'profile rbd pool=<pool-name>'
What the update to 2.15.0 does
The migration runs when system services are updated to 2.15.0, on the management cluster and on the client cluster.
- If shturval-ceph-cephfs and shturval-ceph-rbd are Off (Absent) or are not in the cluster, the objects of these services are deleted. shturval-ceph-csi stays Off (Absent): operator objects are not created, and the namespace and secrets are left as they are.
- If shturval-ceph-cephfs and shturval-ceph-rbd are Auto or Manual, shturval-ceph-csi is turned on in Auto. The Manual mode is not carried over to shturval-ceph-csi.
The namespaces ceph-fs and ceph-rbd and the secrets in them stay, and the StorageClass is not changed: existing volumes keep working.
If the configuration has no monitor addresses and no clusterID, or one clusterID has different monitor lists, the migration stops. shturval-ceph-cephfs and shturval-ceph-rbd are not switched to Off.