multus: Add sample job manifest for multus config validation

Documentation/CRDs/Cluster/ceph-cluster-crd.md

@@ -294,12 +294,16 @@ installing any Custom Resources, run the tool from the operator pod.
 The tool's CLI is designed to be as helpful as possible. Get help text for the multus validation
 tool like so:
 ```console
-kubectl --namespace rook-ceph exec -it deploy/rook-ceph-operator -- rook ctl multus validation run --help
+kubectl --namespace rook-ceph exec -it deploy/rook-ceph-operator -- rook multus validation run --help
 ```
 
+Then, update the args in the [multus-validation](https://github.com/rook/rook/blob/master/deploy/examples/multus-validation.yaml) job template. Minimally, add the NAD names(s) for public and/or cluster as needed and and then, create the job to validate the Multus configuration.
+
 If the tool fails, it will suggest what things may be preventing Multus networks from working
 properly, and it will request the logs and outputs that will help debug issues.
 
+Check the logs of the pod created by the job to know the status of the validation test.
+
 ##### Known limitations with Multus
 
 Daemons leveraging Kubernetes service IPs (Monitors, Managers, Rados Gateways) are not listening on the NAD specified in the `selectors`.

deploy/examples/multus-validation.yaml

@@ -0,0 +1,140 @@
+#################################################################################################################
+# We highly recommend validating your Multus configuration before you install Rook.
+# This job aims to automate that operation by using the validation tool. Run this job after
+# installing the rook operator and before installing any Custom Resources.
+# Insert the NAD name for public network and cluster network in the Job definition below.
+# If you want to use any other flags along with the basic command in the Job,
+# add the `--help` flag in the end to see the list of flags available, and use accordingly.
+#################################################################################################################
+---
+# Service account for job that validates multus configuration
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rook-ceph-multus-validation
+  namespace: rook-ceph # namespace:cluster
+# imagePullSecrets:
+#   - name: my-registry-secret
+---
+# Aspects of multus validation job that require access to the operator/cluster namespace
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rook-ceph-multus-validation
+  namespace: rook-ceph # namespace:cluster
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps", "configmaps/finalizers", "pods"]
+    verbs: ["get", "list", "create", "update", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets"]
+    verbs: ["list", "create", "delete", "deletecollection"]
+  - apiGroups: ["k8s.cni.cncf.io"]
+    resources: ["network-attachment-definitions"]
+    verbs: ["get"]
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["get", "list", "delete"]
+---
+# Allow the multus validation job to run in this namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: rook-ceph-multus-validation
+  namespace: rook-ceph # namespace:cluster
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: rook-ceph-multus-validation
+subjects:
+  - kind: ServiceAccount
+    name: rook-ceph-multus-validation
+    namespace: rook-ceph # namespace:cluster
+---
+# A job that runs the multus validation tool
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: rook-ceph-multus-validation
+  namespace: rook-ceph # namespace:cluster
+  labels:
+    app: rook-ceph-multus-validation
+spec:
+  template:
+    metadata:
+      labels:
+        app: rook-ceph-multus-validation
+    spec:
+      serviceAccountName: rook-ceph-multus-validation
+      containers:
+        - name: multus-validation
+          image: rook/ceph:master
+          command: ["rook"]
+          args:
+            - "multus"
+            - "validation"
+            - "run"
+            # - "--public-network=<NAD-NAME>" # uncomment and replace NAD name if using public network
+            # - "--cluster-network=<NAD-NAME>" # uncomment and replace NAD name if using cluster network
+            # - "--nginx-image=<IMAGE>" # uncomment and replace IMAGE with the nginx image you want use for the validation server and clients
+            # - "--daemons-per-node=<COUNT>" # uncomment and replace COUNT with the maximum number of daemons that should be running on each node during validation
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: ROOK_LOG_LEVEL
+              value: DEBUG
+      restartPolicy: Never
+---
+# This Pod Security Policy (PSP) allows the job to run in Kubernetes environments using PSPs
+# apiVersion: rbac.authorization.k8s.io/v1
+# kind: RoleBinding
+# metadata:
+#   name: rook-ceph-multus-validation-psp
+#   namespace: rook-ceph # namespace:cluster
+# roleRef:
+#   apiGroup: rbac.authorization.k8s.io
+#   kind: ClusterRole
+#   name: psp:rook
+# subjects:
+#   - kind: ServiceAccount
+#     name: rook-ceph-multus-validation
+#     namespace: rook-ceph # namespace:cluster
+# ---
+# SecurityContextConstraints(SCC) for the Rook and Ceph daemons
+# kind: SecurityContextConstraints
+# apiVersion: security.openshift.io/v1
+# metadata:
+#   name: rook-ceph-multus-validation
+# allowPrivilegedContainer: true
+# allowHostDirVolumePlugin: true
+# allowHostPID: false
+# # set to true if running rook with host networking enabled
+# allowHostNetwork: true
+# # set to true if running rook with the provider as host
+# allowHostPorts: true
+# priority:
+# allowedCapabilities: ["MKNOD"]
+# allowHostIPC: true
+# readOnlyRootFilesystem: false
+# # drop all default privileges
+# requiredDropCapabilities: ["All"]
+# defaultAddCapabilities: []
+# runAsUser:
+#   type: RunAsAny
+# seLinuxContext:
+#   type: RunAsAny
+# fsGroup:
+#   type: RunAsAny
+# supplementalGroups:
+#   type: RunAsAny
+# seccompProfiles:
+#   - "*"
+# volumes:
+#   - configMap
+#   - emptyDir
+#   - projected
+# users:
+#   - system:serviceaccount:rook-ceph:rook-ceph-multus-validation # serviceaccount:namespace:cluster
+---