Repository: rook/rook
Pull request #6144 (2020-08-24 09:32:18)

build: allow golang 1.15
**Description of your changes:**

Added Golang 1.15 to the supported versions in the Makefile check.

Signed-off-by: Alexander Trost <galexrt@googlemail.com>

**Checklist:**

- [x] **Commit Message Formatting**: Commit titles and messages follow guidelines in the [developer guide](https://rook.io/docs/rook/master/development-flow.html#commit-structure).
- [x] **Skip Tests for Docs**: Add the flag for skipping the build if this is only a documentation change. See [here](https://github.com/rook/rook/blob/master/INSTALL.md#skip-ci) for the flag.
- [x] **Skip Unrelated Tests**: Add a flag to run tests for a specific storage provider. See [test options](https://github.com/rook/rook/blob/master/INSTALL.md#test-storage-provider).
- [x] Reviewed the developer guide on [Submitting a Pull Request](https://rook.io/docs/rook/master/development-flow.html#submitting-a-pull-request)
- [x] Documentation has been updated, if necessary.
- [x] Unit tests have been added, if necessary.
- [x] Integration tests have been added, if necessary.
- [x] Pending release notes updated with breaking and/or notable changes, if necessary.
- [x] Upgrade from previous release is tested and upgrade user guide is updated, if necessary.
- [x] Code generation (`make codegen`) has been run to update object specifications, if necessary.


Patch:
diff --git a/Documentation/ceph-advanced-configuration.md b/Documentation/ceph-advanced-configuration.md
index 0a59a5299..5156f9a59 100644
--- a/Documentation/ceph-advanced-configuration.md
+++ b/Documentation/ceph-advanced-configuration.md
@@ -72,7 +72,7 @@ For more information on using the Ceph feature to limit access to CephFS paths,
 **This ClusterRole is needed no matter if you want to use a RoleBinding per namespace or a ClusterRoleBinding.**
 
 ```yaml
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-agent-mount
@@ -101,7 +101,7 @@ Replace `namespace: name-of-namespace-with-mountsecret` according to the name of
 
 ```yaml
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-agent-mount
   namespace: name-of-namespace-with-mountsecret
@@ -124,7 +124,7 @@ This ClusterRoleBinding only needs to be created once, as it covers the whole cl
 
 ```yaml
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-agent-mount
   labels:
@@ -421,7 +421,7 @@ For example,
 
 ```yaml
   network:
-    provider: host
+    hostNetwork: true
 ```
 
 > IMPORTANT: Changing this setting is not supported in a running Rook cluster. Host networking
diff --git a/Documentation/ceph-cluster-crd.md b/Documentation/ceph-cluster-crd.md
index 2f8f5204d..4c0a93600 100755
--- a/Documentation/ceph-cluster-crd.md
+++ b/Documentation/ceph-cluster-crd.md
@@ -219,7 +219,6 @@ To use host networking, set `provider: host`.
 #### Multus (EXPERIMENTAL)
 
 Rook has experimental support for Multus.
-Currently there is an [open issue](https://github.com/ceph/ceph-csi/issues/1323) in ceph-csi which explains the csi-rbdPlugin issue while using multus network.
 
 The selector keys are required to be `public` and `cluster` where each represent:
 
@@ -310,13 +309,11 @@ The following are the settings for Storage Class Device Sets which can be config
 
   However, if there are more OSDs than nodes, this anti-affinity will not be effective. Another placement scheme to consider is to add labels to the nodes in such a way that the OSDs can be grouped on those nodes, create multiple storageClassDeviceSets, and add node affinity to each of the device sets that will place the OSDs in those sets of nodes.
 
-* `preparePlacement`: The placement criteria for the preparation of the OSD devices. Creating OSDs is a two-step process and the prepare job may require different placement than the OSD daemons. If the `preparePlacement` is not specified, the `placement` will instead be applied for consistent placement for the OSD prepare jobs and OSD deployments. The `preparePlacement` is only useful for `portable` OSDs in the device sets. OSDs that are not portable will be tied to the host where the OSD prepare job initially runs.
-   * For example, provisioning may require topology spread constraints across zones, but the OSD daemons may require constraints across hosts within the zones.
 * `portable`: If `true`, the OSDs will be allowed to move between nodes during failover. This requires a storage class that supports portability (e.g. `aws-ebs`, but not the local storage provisioner). If `false`, the OSDs will be assigned to a node permanently. Rook will configure Ceph's CRUSH map to support the portability.
 * `tuneDeviceClass`: If `true`, because the OSD can be on a slow device class, Rook will adapt to that by tuning the OSD process. This will make Ceph perform better under that slow device.
 * `volumeClaimTemplates`: A list of PVC templates to use for provisioning the underlying storage devices.
   * `resources.requests.storage`: The desired capacity for the underlying storage devices.
-  * `storageClassName`: The StorageClass to provision PVCs from. Default would be to use the cluster-default StorageClass. This StorageClass should provide a raw block device, multipath device, or logical volume. Other types are not supported. If you want to use logical volume, please see [known issue of OSD on LV-backed PVC](ceph-common-issues.md#lvm-metadata-can-be-corrupted-with-osd-on-lv-backed-pvc)
+  * `storageClassName`: The StorageClass to provision PVCs from. Default would be to use the cluster-default StorageClass. This StorageClass should provide a raw block device, multipath device, or logical volume. Other types are not supported.
   * `volumeMode`: The volume mode to be set for the PVC. Which should be Block
   * `accessModes`: The access mode for the PVC to be bound by OSD.
 * `schedulerName`: Scheduler name for OSD pod placement. (Optional)
@@ -424,15 +421,19 @@ It scrapes for Ceph daemon core dumps and sends them to the Ceph manager crash m
 You can read more about the [Ceph Crash module](https://docs.ceph.com/docs/master/mgr/crash/).
 * `cleanup`: Set resource requests/limits for cleanup job, responsible for wiping cluster's data after uninstall
 
-In order to provide the best possible experience running Ceph in containers, Rook internally recommends minimum memory limits if resource limits are passed.
-If a user configures a limit or request value that is too low, Rook will still run the pod(s) and print a warning to the operator log.
+In order to provide the best possible experience running Ceph in containers, Rook internally enforces minimum memory limits if resource limits are passed.
+If a user configures a limit or request value that is too low, Rook will refuse to run the pod(s).
+Here are the current minimum amounts of memory in MB to apply so that Rook will agree to run Ceph pods:
 
 * `mon`: 1024MB
 * `mgr`: 512MB
 * `osd`: 2048MB
 * `mds`: 4096MB
-* `prepareosd`: 50MB
-* `crashcollector`: 60MB
+
+Rook does not enforce any minimum limit nor request on the following:
+
+* prepare OSD pod: This pod commonly takes up to 50MB, but depending on the OSD scenario may need more memory. 100MB would be more conservative.
+* crashcollector pod: This pod commonly takes around 60MB.
 
 ### Resource Requirements/Limits
 
@@ -1145,8 +1146,8 @@ In Ceph Cluster let us list the pools available:
 
 ```console
 rados df
-POOL_NAME     USED OBJECTS CLONES COPIES MISSING_ON_PRIMARY UNFOUND DEGRADED RD_OPS  RD WR_OPS  WR USED COMPR UNDER COMPR
-replicated_2g  0 B       0      0      0                  0       0        0      0 0 B      0 0 B        0 B         0 B
+POOL_NAME     USED OBJECTS CLONES COPIES MISSING_ON_PRIMARY UNFOUND DEGRADED RD_OPS  RD WR_OPS  WR USED COMPR UNDER COMPR 
+replicated_2g  0 B       0      0      0                  0       0        0      0 0 B      0 0 B        0 B         0 B 
 ```
 
 Here is an example StorageClass configuration that uses the `replicated_2g` pool from the external cluster:
diff --git a/Documentation/ceph-common-issues.md b/Documentation/ceph-common-issues.md
index 2648deb8b..7862cf0be 100644
--- a/Documentation/ceph-common-issues.md
+++ b/Documentation/ceph-common-issues.md
@@ -27,7 +27,6 @@ If after trying the suggestions found on this page and the problem is not resolv
 * [Flex storage class versus Ceph CSI storage class](#flex-storage-class-versus-ceph-csi-storage-class)
 * [A worker node using RBD devices hangs up](#a-worker-node-using-rbd-devices-hangs-up)
 * [Too few PGs per OSD warning is shown](#too-few-pgs-per-osd-warning-is-shown)
-* [LVM metadata can be corrupted with OSD on LV-backed PVC](#lvm-metadata-can-be-corrupted-with-osd-on-lv-backed-pvc)
 
 ## Troubleshooting Techniques
 
@@ -801,16 +800,3 @@ You can bypass this problem by using ext4 or any other filesystems rather than X
 The meaning of this warning is written in [the document](https://docs.ceph.com/docs/master/rados/operations/health-checks#too-few-pgs).
 However, in many cases it is benign. For more information, please see [the blog entry](http://ceph.com/community/new-luminous-pg-overdose-protection/).
 Please refer to [Configuring Pools](ceph-advanced-configuration.md#configuring-pools) if you want to know the proper `pg_num` of pools and change these values.
-
-## LVM metadata can be corrupted with OSD on LV-backed PVC
-
-### Symptoms
-
-There is a critical flaw in OSD on LV-backed PVC. LVM metadata can be corrupted if both the host and OSD container modify it simultaneously. For example, the administrator might modify it on the host, while the OSD initialization process in a container could modify it too. If you still decide to configure an OSD on LVM, please keep the following in mind to reduce the probability of this issue.
-
-### Solution
-
-- Avoid configuration of LVs from the host. In addition, don't touch the VGs and physical volumes that back these LVs. 
-- Avoid incrementing the `count` field of `storageClassDeviceSets` and create a new LV that backs a OSD simultaneously.
-
-You can know whether the above-mentioned tag exists tag with the command: `sudo lvs -o lv_name,lv_tags`. If the `lv_tag` field is empty in an LV corresponding to the OSD lv_tags, this OSD encountered the problem. In this case, please [retire this OSD](ceph-osd-mgmt.md#remove-an-osd) or replace with other new OSD before restarting.
diff --git a/Documentation/development-environment.md b/Documentation/development-environment.md
index 81d4d61a9..2f910d0e7 100644
--- a/Documentation/development-environment.md
+++ b/Documentation/development-environment.md
@@ -214,7 +214,3 @@ For more information or if you are experiencing issues, please create an issue a
 ## Using Vagrant on Linux with libvirt
 
 See https://github.com/noahdesu/kubensis.
-
-## Using CodeReady Containers for setting up single node openshift 4.x cluster
-
-See https://code-ready.github.io/crc/
diff --git a/Documentation/development-flow.md b/Documentation/development-flow.md
index f5a58bbf3..030cee45a 100644
--- a/Documentation/development-flow.md
+++ b/Documentation/development-flow.md
@@ -50,8 +50,6 @@ make IMAGES="cassandra" build
 make IMAGES="cassandra ceph" build
 ```
 
-If you want to use `podman` instead of `docker` then uninstall `docker` packages from your machine, make will automatically pick up `podman`.
-
 ### Development Settings
 
 To provide consistent whitespace and other formatting in your `go` and other source files (e.g., Markdown), it is recommended you apply
diff --git a/Documentation/edgefs-cluster-crd.md b/Documentation/edgefs-cluster-crd.md
index b7166e8c2..ea20775ae 100644
--- a/Documentation/edgefs-cluster-crd.md
+++ b/Documentation/edgefs-cluster-crd.md
@@ -536,7 +536,7 @@ metadata:
   namespace: rook-edgefs
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
@@ -550,7 +550,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster-mgmt
   namespace: rook-edgefs
@@ -565,7 +565,7 @@ subjects:
 ---
 # Allow the pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
diff --git a/build/makelib/golang.mk b/build/makelib/golang.mk
index d6e27880a..3ec2770df 100644
--- a/build/makelib/golang.mk
+++ b/build/makelib/golang.mk
@@ -48,7 +48,7 @@ GO_TEST_FLAGS ?=
 # ====================================================================================
 # Setup go environment
 
-GO_SUPPORTED_VERSIONS ?= 1.13|1.14
+GO_SUPPORTED_VERSIONS ?= 1.13|1.14|1.15
 
 GO_PACKAGES := $(foreach t,$(GO_SUBDIRS),$(GO_PROJECT)/$(t)/...)
 GO_INTEGRATION_TEST_PACKAGES := $(foreach t,$(GO_INTEGRATION_TESTS_SUBDIRS),$(GO_PROJECT)/$(t)/integration)
diff --git a/cluster/charts/rook-ceph/templates/clusterrole.yaml b/cluster/charts/rook-ceph/templates/clusterrole.yaml
index e0cf3920e..311206b35 100644
--- a/cluster/charts/rook-ceph/templates/clusterrole.yaml
+++ b/cluster/charts/rook-ceph/templates/clusterrole.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.rbacEnable }}
 # The cluster role for managing all the cluster-specific resources in a namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-cluster-mgmt
@@ -30,7 +30,7 @@ rules:
   - delete
 ---
 # The cluster role for managing the Rook CRDs
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global
@@ -142,7 +142,7 @@ rules:
 ---
 # Aspects of ceph-mgr that require cluster-wide access
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
   labels:
@@ -172,7 +172,7 @@ rules:
 ---
 # Aspects of ceph-mgr that require access to the system namespace
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
 rules:
@@ -186,7 +186,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
   labels:
@@ -216,7 +216,7 @@ rules:
   - "*"
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
 rules:
@@ -230,7 +230,7 @@ rules:
 # Use a default dict to avoid 'can't give argument to non-function' errors from text/template
 {{- if ne ((.Values.agent | default (dict "mountSecurityMode" "")).mountSecurityMode | default "") "Any" }}
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-agent-mount
@@ -389,7 +389,7 @@ rules:
 {{- end }}
 {{- if .Values.pspEnable }}
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: 'psp:rook'
diff --git a/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml b/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
index b0d679eec..c41c82ffa 100644
--- a/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
+++ b/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
@@ -1,7 +1,7 @@
 {{- if .Values.rbacEnable }}
 # Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-global
   labels:
@@ -19,7 +19,7 @@ subjects:
 ---
 # Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
 roleRef:
@@ -33,7 +33,7 @@ subjects:
 ---
 # Allow the ceph osd to access cluster-wide resources necessary for determining their topology location
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
 roleRef:
@@ -46,7 +46,7 @@ subjects:
   namespace: {{ .Release.Namespace }}
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
 roleRef:
@@ -134,7 +134,7 @@ subjects:
     name: default
     namespace: {{ .Release.Namespace }}
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: rook-ceph-system-psp-users
diff --git a/cluster/charts/rook-ceph/templates/role.yaml b/cluster/charts/rook-ceph/templates/role.yaml
index ab0059f6e..f9b912f0d 100644
--- a/cluster/charts/rook-ceph/templates/role.yaml
+++ b/cluster/charts/rook-ceph/templates/role.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.rbacEnable }}
 # The role for the operator to manage resources in its own namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-ceph-system
@@ -45,7 +45,7 @@ rules:
   - get
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace:  {{  .Release.Namespace }}
@@ -59,7 +59,7 @@ rules:
 ---
 # Aspects of ceph-mgr that operate within the cluster's namespace
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace:  {{  .Release.Namespace }}
@@ -94,7 +94,7 @@ rules:
   - "*"
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace:  {{  .Release.Namespace }}
diff --git a/cluster/charts/rook-ceph/templates/rolebinding.yaml b/cluster/charts/rook-ceph/templates/rolebinding.yaml
index 44c812c70..740a2157d 100644
--- a/cluster/charts/rook-ceph/templates/rolebinding.yaml
+++ b/cluster/charts/rook-ceph/templates/rolebinding.yaml
@@ -1,7 +1,7 @@
 {{- if .Values.rbacEnable }}
 # Grant the operator, agent, and discovery agents access to resources in the rook-ceph-system namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-system
   namespace: {{ .Release.Namespace }}
@@ -19,7 +19,7 @@ subjects:
 ---
   # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cluster-mgmt
   namespace: {{ .Release.Namespace }}
@@ -34,7 +34,7 @@ subjects:
 ---
 # Allow the osd pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: {{ .Release.Namespace }}
@@ -49,7 +49,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the cluster-specific resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace: {{ .Release.Namespace }}
@@ -64,7 +64,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the rook system resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
   namespace: {{ .Release.Namespace }}
@@ -78,7 +78,7 @@ subjects:
   namespace: {{ .Release.Namespace }}
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: {{ .Release.Namespace }}
diff --git a/cluster/examples/coreos/rbac.yaml b/cluster/examples/coreos/rbac.yaml
index 03741a17a..156c00d82 100644
--- a/cluster/examples/coreos/rbac.yaml
+++ b/cluster/examples/coreos/rbac.yaml
@@ -14,7 +14,7 @@ rules:
   verbs: ["patch", "get"]
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-node-annotator
 roleRef:
diff --git a/cluster/examples/kubernetes/ceph/cluster-on-pvc.yaml b/cluster/examples/kubernetes/ceph/cluster-on-pvc.yaml
index f44b9762c..fcabe9339 100644
--- a/cluster/examples/kubernetes/ceph/cluster-on-pvc.yaml
+++ b/cluster/examples/kubernetes/ceph/cluster-on-pvc.yaml
@@ -62,20 +62,13 @@ spec:
       encrypted: false
       # Since the OSDs could end up on any node, an effort needs to be made to spread the OSDs
       # across nodes as much as possible. Unfortunately the pod anti-affinity breaks down
-      # as soon as you have more than one OSD per node. The topology spread constraints will
-      # give us an even spread on K8s 1.18 or newer.
+      # as soon as you have more than one OSD per node. If you have more OSDs than nodes, K8s may
+      # choose to schedule many of them on the same node. What we need is the Pod Topology
+      # Spread Constraints.
+      # Another approach for a small number of OSDs is to create a separate device set for each
+      # zone (or other set of nodes with a common label) so that the OSDs will end up on different
+      # nodes. This would require adding nodeAffinity to the placement here.
       placement:
-        topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchExpressions:
-            - key: app
-              operator: In
-              values:
-              - rook-ceph-osd
-      preparePlacement:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 100
@@ -93,16 +86,16 @@ spec:
               topologyKey: kubernetes.io/hostname
         topologySpreadConstraints:
         - maxSkew: 1
-          topologyKey: topology.kubernetes.io/zone
-          whenUnsatisfiable: ScheduleAnyway
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
           labelSelector:
             matchExpressions:
             - key: app
               operator: In
               values:
+              - rook-ceph-osd
               - rook-ceph-osd-prepare
       resources:
-      # These are the OSD daemon limits. For OSD prepare limits, see the separate section below for "prepareosd" resources
       #   limits:
       #     cpu: "500m"
       #     memory: "4Gi"
@@ -152,14 +145,6 @@ spec:
       #       - ReadWriteOnce
       # Scheduler name for OSD pod placement
       # schedulerName: osd-scheduler
-  resources:
-  #  prepareosd:
-  #    limits:
-  #      cpu: "200m"
-  #      memory: "200Mi"
-  #   requests:
-  #      cpu: "200m"
-  #      memory: "200Mi"
   disruptionManagement:
     managePodBudgets: false
     osdMaintenanceTimeout: 30
diff --git a/cluster/examples/kubernetes/ceph/common-external.yaml b/cluster/examples/kubernetes/ceph/common-external.yaml
index a6d054c30..530cba8c1 100644
--- a/cluster/examples/kubernetes/ceph/common-external.yaml
+++ b/cluster/examples/kubernetes/ceph/common-external.yaml
@@ -26,7 +26,7 @@ metadata:
   name: rook-ceph-external
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cluster-mgmt
   namespace: rook-ceph-external
@@ -40,7 +40,7 @@ subjects:
   namespace: rook-ceph
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: rook-ceph-external
@@ -60,7 +60,7 @@ metadata:
   namespace: rook-ceph-external
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: rook-ceph-external
diff --git a/cluster/examples/kubernetes/ceph/common.yaml b/cluster/examples/kubernetes/ceph/common.yaml
index 738f52355..d6ecdb57b 100644
--- a/cluster/examples/kubernetes/ceph/common.yaml
+++ b/cluster/examples/kubernetes/ceph/common.yaml
@@ -755,7 +755,7 @@ spec:
 # OLM: BEGIN OBJECTBUCKET ROLEBINDING
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
 roleRef:
@@ -799,7 +799,7 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
 ---
 # The cluster role for managing all the cluster-specific resources in a namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-cluster-mgmt
@@ -829,7 +829,7 @@ rules:
   - delete
 ---
 # The role for the operator to manage resources in its own namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-ceph-system
@@ -874,7 +874,7 @@ rules:
   - get
 ---
 # The cluster role for managing the Rook CRDs
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global
@@ -986,7 +986,7 @@ rules:
 ---
 # Aspects of ceph-mgr that require cluster-wide access
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
   labels:
@@ -1015,7 +1015,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
   labels:
@@ -1063,7 +1063,7 @@ metadata:
 ---
 # Grant the operator, agent, and discovery agents access to resources in the namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-system
   namespace: rook-ceph
@@ -1081,7 +1081,7 @@ subjects:
 ---
 # Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-global
   labels:
@@ -1136,7 +1136,7 @@ metadata:
 # OLM: BEGIN CLUSTER ROLE
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: rook-ceph
@@ -1149,7 +1149,7 @@ rules:
   verbs: [ "get", "list", "create", "update", "delete" ]
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
 rules:
@@ -1163,7 +1163,7 @@ rules:
 ---
 # Aspects of ceph-mgr that require access to the system namespace
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
 rules:
@@ -1178,7 +1178,7 @@ rules:
 ---
 # Aspects of ceph-mgr that operate within the cluster's namespace
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace: rook-ceph
@@ -1215,7 +1215,7 @@ rules:
 # OLM: BEGIN CMD REPORTER ROLE
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: rook-ceph
@@ -1237,7 +1237,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cluster-mgmt
   namespace: rook-ceph
@@ -1252,7 +1252,7 @@ subjects:
 ---
 # Allow the osd pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: rook-ceph
@@ -1267,7 +1267,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the cluster-specific resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace: rook-ceph
@@ -1282,7 +1282,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the rook system resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
   namespace: rook-ceph
@@ -1297,7 +1297,7 @@ subjects:
 ---
 # Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
 roleRef:
@@ -1312,7 +1312,7 @@ subjects:
 ---
 # Allow the ceph osd to access cluster-wide resources necessary for determining their topology location
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
 roleRef:
@@ -1328,7 +1328,7 @@ subjects:
 # OLM: BEGIN CMD REPORTER ROLEBINDING
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: rook-ceph
diff --git a/cluster/examples/kubernetes/ceph/monitoring/prometheus.yaml b/cluster/examples/kubernetes/ceph/monitoring/prometheus.yaml
index df25ad975..287b4b1e5 100644
--- a/cluster/examples/kubernetes/ceph/monitoring/prometheus.yaml
+++ b/cluster/examples/kubernetes/ceph/monitoring/prometheus.yaml
@@ -4,7 +4,7 @@ metadata:
   name: prometheus
   namespace: rook-ceph
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: prometheus
@@ -14,7 +14,7 @@ aggregationRule:
       rbac.ceph.rook.io/aggregate-to-prometheus: "true"
 rules: []
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: prometheus-rules
@@ -35,7 +35,7 @@ rules:
 - nonResourceURLs: ["/metrics"]
   verbs: ["get"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: prometheus
diff --git a/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml b/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
index 0a9d80537..362ccacfa 100644
--- a/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
+++ b/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
@@ -2,7 +2,7 @@
 # OLM: BEGIN ROLE
 # Aspects for creation of monitoring resources
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-monitor
   namespace: rook-ceph
@@ -18,7 +18,7 @@ rules:
 # OLM: BEGIN ROLE BINDING
 # Allow creation of monitoring resources
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-monitor
   namespace: rook-ceph
@@ -35,7 +35,7 @@ subjects:
 # OLM: BEGIN ROLE
 # Aspects for metrics collection
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-metrics
   namespace: rook-ceph
@@ -55,7 +55,7 @@ rules:
 # OLM: BEGIN ROLE BINDING
 # Allow collection of metrics
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-metrics
   namespace: rook-ceph
diff --git a/cluster/examples/kubernetes/ceph/object-ec.yaml b/cluster/examples/kubernetes/ceph/object-ec.yaml
index 83d83a041..ddc31a7a2 100644
--- a/cluster/examples/kubernetes/ceph/object-ec.yaml
+++ b/cluster/examples/kubernetes/ceph/object-ec.yaml
@@ -15,29 +15,14 @@ spec:
     failureDomain: host
     replicated:
       size: 3
-      # Disallow setting pool with replica 1, this could lead to data loss without recovery.
-      # Make sure you're *ABSOLUTELY CERTAIN* that is what you want
-      requireSafeReplicaSize: true
-    parameters:
-      # Inline compression mode for the data pool
-      # Further reference: https://docs.ceph.com/docs/nautilus/rados/configuration/bluestore-config-ref/#inline-compression
-      compression_mode: none
-      # gives a hint (%) to Ceph in terms of expected consumption of the total cluster capacity of a given pool
-      # for more info: https://docs.ceph.com/docs/master/rados/operations/placement-groups/#specifying-expected-pool-size
-      #target_size_ratio: ".5"
   # The pool spec used to create the data pool. Can use replication or erasure coding.
   dataPool:
     failureDomain: host
     erasureCoded:
       dataChunks: 2
       codingChunks: 1
-    parameters:
-      # Inline compression mode for the data pool
-      # Further reference: https://docs.ceph.com/docs/nautilus/rados/configuration/bluestore-config-ref/#inline-compression
-      compression_mode: none
-      # gives a hint (%) to Ceph in terms of expected consumption of the total cluster capacity of a given pool
-      # for more info: https://docs.ceph.com/docs/master/rados/operations/placement-groups/#specifying-expected-pool-size
-      #target_size_ratio: ".5"
+    # Inline compression mode for the data pool
+    compressionMode: none
   # Whether to preserve metadata and data pools on object store deletion
   preservePoolsOnDelete: true
   # The gateway service configuration
@@ -49,7 +34,7 @@ spec:
     # The port that RGW pods will listen on (http)
     port: 80
     # The port that RGW pods will listen on (https). An ssl certificate is required.
-    # securePort: 443
+    securePort:
     # The number of pods in the rgw deployment
     instances: 1
     # The affinity rules to apply to the rgw deployment or daemonset.
@@ -79,13 +64,3 @@ spec:
     #    cpu: "500m"
     #    memory: "1024Mi"
     # priorityClassName: my-priority-class
-  #zone:
-    #name: zone-a
-  # service endpoint healthcheck
-  healthCheck:
-    bucket:
-      disabled: false
-      interval: 60s
-    # Configure the pod liveness probe for the rgw daemon
-    livenessProbe:
-      disabled: false
diff --git a/cluster/examples/kubernetes/ceph/object-openshift.yaml b/cluster/examples/kubernetes/ceph/object-openshift.yaml
index eac4a42af..1da122f56 100644
--- a/cluster/examples/kubernetes/ceph/object-openshift.yaml
+++ b/cluster/examples/kubernetes/ceph/object-openshift.yaml
@@ -15,31 +15,13 @@ spec:
     failureDomain: host
     replicated:
       size: 3
-      # Disallow setting pool with replica 1, this could lead to data loss without recovery.
-      # Make sure you're *ABSOLUTELY CERTAIN* that is what you want
-      requireSafeReplicaSize: true
-    parameters:
-      # Inline compression mode for the data pool
-      # Further reference: https://docs.ceph.com/docs/nautilus/rados/configuration/bluestore-config-ref/#inline-compression
-      compression_mode: none
-      # gives a hint (%) to Ceph in terms of expected consumption of the total cluster capacity of a given pool
-      # for more info: https://docs.ceph.com/docs/master/rados/operations/placement-groups/#specifying-expected-pool-size
-      #target_size_ratio: ".5"
   # The pool spec used to create the data pool. Can use replication or erasure coding.
   dataPool:
     failureDomain: host
     replicated:
       size: 3
-      # Disallow setting pool with replica 1, this could lead to data loss without recovery.
-      # Make sure you're *ABSOLUTELY CERTAIN* that is what you want
-      requireSafeReplicaSize: true
-    parameters:
-      # Inline compression mode for the data pool
-      # Further reference: https://docs.ceph.com/docs/nautilus/rados/configuration/bluestore-config-ref/#inline-compression
-      compression_mode: none
-      # gives a hint (%) to Ceph in terms of expected consumption of the total cluster capacity of a given pool
-      # for more info: https://docs.ceph.com/docs/master/rados/operations/placement-groups/#specifying-expected-pool-size
-      #target_size_ratio: ".5"
+    # Inline compression mode for the data pool
+    compressionMode: none
   # Whether to preserve metadata and data pools on object store deletion
   preservePoolsOnDelete: true
   # The gateway service configuration
@@ -51,7 +33,7 @@ spec:
     # The port that RGW pods will listen on (http)
     port: 8080
     # The port that RGW pods will listen on (https). An ssl certificate is required.
-    # securePort: 443
+    securePort:
     # The number of pods in the rgw deployment
     instances: 1
     # The affinity rules to apply to the rgw deployment or daemonset.
@@ -82,13 +64,3 @@ spec:
     #    cpu: "500m"
     #    memory: "1024Mi"
     # priorityClassName: my-priority-class
-   #zone:
-    #name: zone-a
-  # service endpoint healthcheck
-  healthCheck:
-    bucket:
-      disabled: false
-      interval: 60s
-    # Configure the pod liveness probe for the rgw daemon
-    livenessProbe:
-      disabled: false
diff --git a/cluster/examples/kubernetes/ceph/upgrade-from-v1.3-apply.yaml b/cluster/examples/kubernetes/ceph/upgrade-from-v1.3-apply.yaml
index db2b1a723..7f987fc7c 100644
--- a/cluster/examples/kubernetes/ceph/upgrade-from-v1.3-apply.yaml
+++ b/cluster/examples/kubernetes/ceph/upgrade-from-v1.3-apply.yaml
@@ -1,4 +1,4 @@
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global
@@ -108,7 +108,7 @@ rules:
   - create
   - delete
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-cluster-mgmt
@@ -138,7 +138,7 @@ rules:
   - delete
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
   labels:
@@ -167,7 +167,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
   labels:
@@ -197,7 +197,7 @@ rules:
   - "*"
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
 rules:
diff --git a/cluster/examples/kubernetes/cockroachdb/operator.yaml b/cluster/examples/kubernetes/cockroachdb/operator.yaml
index fde8fb25e..0480b9554 100644
--- a/cluster/examples/kubernetes/cockroachdb/operator.yaml
+++ b/cluster/examples/kubernetes/cockroachdb/operator.yaml
@@ -17,7 +17,7 @@ spec:
   scope: Namespaced
   version: v1alpha1
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-cockroachdb-operator
@@ -61,7 +61,7 @@ metadata:
   namespace: rook-cockroachdb-system
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-cockroachdb-operator
 roleRef:
diff --git a/cluster/examples/kubernetes/edgefs/cluster.yaml b/cluster/examples/kubernetes/edgefs/cluster.yaml
index f0ad33194..17f67047f 100644
--- a/cluster/examples/kubernetes/edgefs/cluster.yaml
+++ b/cluster/examples/kubernetes/edgefs/cluster.yaml
@@ -10,7 +10,7 @@ metadata:
   namespace: rook-edgefs
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
@@ -30,7 +30,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster-mgmt
   namespace: rook-edgefs
@@ -45,7 +45,7 @@ subjects:
 ---
 # Allow the pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
diff --git a/cluster/examples/kubernetes/edgefs/cluster_kvssd.yaml b/cluster/examples/kubernetes/edgefs/cluster_kvssd.yaml
index b55447392..d04103e24 100644
--- a/cluster/examples/kubernetes/edgefs/cluster_kvssd.yaml
+++ b/cluster/examples/kubernetes/edgefs/cluster_kvssd.yaml
@@ -10,7 +10,7 @@ metadata:
   namespace: rook-edgefs
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
@@ -30,7 +30,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster-mgmt
   namespace: rook-edgefs
@@ -45,7 +45,7 @@ subjects:
 ---
 # Allow the pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: rook-edgefs
diff --git a/cluster/examples/kubernetes/edgefs/monitoring/prometheus.yaml b/cluster/examples/kubernetes/edgefs/monitoring/prometheus.yaml
index b7af2eb9c..e66f102e6 100644
--- a/cluster/examples/kubernetes/edgefs/monitoring/prometheus.yaml
+++ b/cluster/examples/kubernetes/edgefs/monitoring/prometheus.yaml
@@ -4,7 +4,7 @@ metadata:
   name: prometheus
   namespace: rook-edgefs
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: prometheus
@@ -23,7 +23,7 @@ rules:
 - nonResourceURLs: ["/metrics"]
   verbs: ["get"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: prometheus
diff --git a/cluster/examples/kubernetes/edgefs/operator.yaml b/cluster/examples/kubernetes/edgefs/operator.yaml
index cb8388d14..68cd3d660 100644
--- a/cluster/examples/kubernetes/edgefs/operator.yaml
+++ b/cluster/examples/kubernetes/edgefs/operator.yaml
@@ -281,7 +281,7 @@ spec:
       description: ISGW client' service names
 ---
 # The cluster role for managing all the cluster-specific resources in a namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-edgefs-cluster-mgmt
@@ -300,7 +300,7 @@ rules:
   verbs: ["get", "list", "watch", "create", "update", "delete"]
 ---
 # The role for the operator to manage resources in the system namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-edgefs-system
@@ -317,7 +317,7 @@ rules:
   verbs: ["get", "list", "watch", "create", "update", "delete"]
 ---
 # The cluster role for managing the Rook CRDs
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-edgefs-global
@@ -359,7 +359,7 @@ metadata:
 ---
 # Grant the operator, agent, and discovery agents access to resources in its own namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-system
   namespace: rook-edgefs-system
@@ -377,7 +377,7 @@ subjects:
 ---
 # Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-global
   labels:
diff --git a/cluster/examples/kubernetes/nfs/operator.yaml b/cluster/examples/kubernetes/nfs/operator.yaml
index 1ca65a757..22088ef0a 100644
--- a/cluster/examples/kubernetes/nfs/operator.yaml
+++ b/cluster/examples/kubernetes/nfs/operator.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: rook-nfs-system
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-nfs-operator
 roleRef:
@@ -17,7 +17,7 @@ subjects:
   name: rook-nfs-operator
   namespace: rook-nfs-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-nfs-operator
diff --git a/cluster/examples/kubernetes/nfs/webhook.yaml b/cluster/examples/kubernetes/nfs/webhook.yaml
index ddd6cddf9..a4f32eb24 100644
--- a/cluster/examples/kubernetes/nfs/webhook.yaml
+++ b/cluster/examples/kubernetes/nfs/webhook.yaml
@@ -4,7 +4,7 @@ metadata:
   name: rook-nfs-webhook
   namespace: rook-nfs-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-nfs-webhook
@@ -16,7 +16,7 @@ rules:
   - 'rook-nfs-webhook-cert'
   verbs: ["get", "list", "watch"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
   name: rook-nfs-webhook
diff --git a/cluster/examples/kubernetes/yugabytedb/operator.yaml b/cluster/examples/kubernetes/yugabytedb/operator.yaml
index 4a0c58392..0ba7bce35 100644
--- a/cluster/examples/kubernetes/yugabytedb/operator.yaml
+++ b/cluster/examples/kubernetes/yugabytedb/operator.yaml
@@ -17,7 +17,7 @@ spec:
   scope: Namespaced
   version: v1alpha1
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-yugabytedb-operator
@@ -66,7 +66,7 @@ metadata:
   name: rook-yugabytedb-operator
   namespace: rook-yugabytedb-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: rook-yugabytedb-operator
diff --git a/design/ceph/security-model.md b/design/ceph/security-model.md
index 7c5a5fe8e..34f429fc5 100644
--- a/design/ceph/security-model.md
+++ b/design/ceph/security-model.md
@@ -25,7 +25,7 @@ metadata:
   namespace: rook-system
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-operator
 rules:
@@ -49,7 +49,7 @@ rules:
   verbs: [ "*" ]
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-operator
 roleRef:
@@ -74,7 +74,7 @@ metadata:
   namespace: rook-system
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-agent
 rules:
@@ -89,7 +89,7 @@ rules:
   verbs: [ "get", "list", "watch", "create", "update" ]
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-agent
 roleRef:
@@ -130,7 +130,7 @@ metadata:
   namespace: mycluster
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-api
   namespace: mycluster
@@ -149,7 +149,7 @@ rules:
   verbs: [ "get", "list", "create" ]
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-api
   namespace: mycluster
@@ -173,7 +173,7 @@ metadata:
   namespace: mycluster
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: mycluster
@@ -183,7 +183,7 @@ rules:
   verbs: [ "get", "list", "watch", "create", "update", "delete" ]
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: mycluster
@@ -218,7 +218,7 @@ The `rook-system` service account is responsible for launching all pods, service
 
 ```yaml
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-system
 rules:
@@ -236,7 +236,7 @@ rules:
   verbs: [ "*" ]
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-system
   namespace: rook-system
@@ -280,7 +280,7 @@ metadata:
   namespace: mycluster
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-cluster
   namespace: mycluster
@@ -290,7 +290,7 @@ rules:
   verbs: [ "get", "list", "watch", "create", "update", "delete" ]
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-cluster
   namespace: mycluster
@@ -304,7 +304,7 @@ subjects:
   namespace: rook-system
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-system
   namespace: mycluster
diff --git a/pkg/apis/ceph.rook.io/v1/resources.go b/pkg/apis/ceph.rook.io/v1/resources.go
index f735b75d6..c53c5d9f7 100644
--- a/pkg/apis/ceph.rook.io/v1/resources.go
+++ b/pkg/apis/ceph.rook.io/v1/resources.go
@@ -30,12 +30,8 @@ const (
 	ResourcesKeyOSD = "osd"
 	// ResourcesKeyPrepareOSD represents the name of resource in the CR for the osd prepare job
 	ResourcesKeyPrepareOSD = "prepareosd"
-	// ResourcesKeyMDS represents the name of resource in the CR for the mds
-	ResourcesKeyMDS = "mds"
 	// ResourcesKeyCrashCollector represents the name of resource in the CR for the crash
 	ResourcesKeyCrashCollector = "crashcollector"
-	// ResourcesKeyRBDMirror represents the name of resource in the CR for the rbd mirror
-	ResourcesKeyRBDMirror = "rbdmirror"
 	// ResourcesKeyCleanup represents the name of resource in the CR for the cleanup
 	ResourcesKeyCleanup = "cleanup"
 )
diff --git a/pkg/apis/rook.io/v1/types.go b/pkg/apis/rook.io/v1/types.go
index 0193f16f3..36306b428 100644
--- a/pkg/apis/rook.io/v1/types.go
+++ b/pkg/apis/rook.io/v1/types.go
@@ -119,8 +119,7 @@ type StorageClassDeviceSet struct {
 	Name                 string                     `json:"name,omitempty"`                 // A unique identifier for the set
 	Count                int                        `json:"count,omitempty"`                // Number of devices in this set
 	Resources            v1.ResourceRequirements    `json:"resources,omitempty"`            // Requests/limits for the devices
-	Placement            Placement                  `json:"placement,omitempty"`            // Placement constraints for the device daemons
-	PreparePlacement     *Placement                 `json:"preparePlacement,omitempty"`     // Placement constraints for the device preparation
+	Placement            Placement                  `json:"placement,omitempty"`            // Placement constraints for the devices
 	Config               map[string]string          `json:"config,omitempty"`               // Provider-specific device configuration
 	VolumeClaimTemplates []v1.PersistentVolumeClaim `json:"volumeClaimTemplates,omitempty"` // List of PVC templates for the underlying storage devices
 	Portable             bool                       `json:"portable,omitempty"`             // OSD portability across the hosts
@@ -135,7 +134,6 @@ type VolumeSource struct {
 	PVCSources          map[string]v1.PersistentVolumeClaimVolumeSource `json:"pvcSources,omitempty"`
 	Resources           v1.ResourceRequirements                         `json:"resources,omitempty"`
 	Placement           Placement                                       `json:"placement,omitempty"`
-	PreparePlacement    *Placement                                      `json:"preparePlacement,omitempty"`
 	Config              map[string]string                               `json:"config,omitempty"`
 	Portable            bool                                            `json:"portable,omitempty"`         // Portable OSD portability across the hosts
 	TuneSlowDeviceClass bool                                            `json:"tuneDeviceClass,omitempty"`  // TuneSlowDeviceClass Tune the OSD when running on a slow Device Class
diff --git a/pkg/daemon/ceph/osd/daemon.go b/pkg/daemon/ceph/osd/daemon.go
index 33fe4d6fd..a1d3d163e 100644
--- a/pkg/daemon/ceph/osd/daemon.go
+++ b/pkg/daemon/ceph/osd/daemon.go
@@ -438,6 +438,12 @@ func getAvailableDevices(context *clusterd.Context, agent *OsdAgent) (*DeviceOsd
 				}
 				matchedDevice = desiredDevice
 
+				// On PVC, we must use the real name not the /mnt name since c-v calls udev
+				// udevadm will fail with
+				// stderr Unknown device, --name=, --path=, or absolute path in /dev/ or /sys expected.
+				if agent.pvcBacked {
+					matchedDevice.Name = device.RealPath
+				}
 				if matched {
 					break
 				}
diff --git a/pkg/operator/ceph/cluster/mgr/mgr.go b/pkg/operator/ceph/cluster/mgr/mgr.go
index 84c9c2b2e..46763a024 100644
--- a/pkg/operator/ceph/cluster/mgr/mgr.go
+++ b/pkg/operator/ceph/cluster/mgr/mgr.go
@@ -103,7 +103,7 @@ func (c *Cluster) getDaemonIDs() []string {
 // Start begins the process of running a cluster of Ceph mgrs.
 func (c *Cluster) Start() error {
 	// Validate pod's memory if specified
-	err := controller.CheckPodMemory(cephv1.ResourcesKeyMgr, cephv1.GetMgrResources(c.spec.Resources), cephMgrPodMinimumMemory)
+	err := controller.CheckPodMemory(cephv1.GetMgrResources(c.spec.Resources), cephMgrPodMinimumMemory)
 	if err != nil {
 		return errors.Wrap(err, "error checking pod memory")
 	}
diff --git a/pkg/operator/ceph/cluster/mon/mon.go b/pkg/operator/ceph/cluster/mon/mon.go
index 0755a7ad9..f0fbf192e 100644
--- a/pkg/operator/ceph/cluster/mon/mon.go
+++ b/pkg/operator/ceph/cluster/mon/mon.go
@@ -200,7 +200,7 @@ func (c *Cluster) Start(clusterInfo *cephclient.ClusterInfo, rookVersion string,
 	}
 
 	// Validate pod's memory if specified
-	err := controller.CheckPodMemory(cephv1.ResourcesKeyMon, cephv1.GetMonResources(c.spec.Resources), cephMonPodMinimumMemory)
+	err := controller.CheckPodMemory(cephv1.GetMonResources(c.spec.Resources), cephMonPodMinimumMemory)
 	if err != nil {
 		return nil, errors.Wrap(err, "error checking pod memory")
 	}
diff --git a/pkg/operator/ceph/cluster/osd/deviceSet.go b/pkg/operator/ceph/cluster/osd/deviceSet.go
index 7aa81c4fb..df21b92e6 100644
--- a/pkg/operator/ceph/cluster/osd/deviceSet.go
+++ b/pkg/operator/ceph/cluster/osd/deviceSet.go
@@ -21,7 +21,6 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
-	cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
 	rookv1 "github.com/rook/rook/pkg/apis/rook.io/v1"
 	"github.com/rook/rook/pkg/operator/ceph/controller"
 	v1 "k8s.io/api/core/v1"
@@ -33,7 +32,7 @@ func (c *Cluster) prepareStorageClassDeviceSets(config *provisionConfig) []rookv
 
 	// Iterate over storageClassDeviceSet
 	for _, storageClassDeviceSet := range c.spec.Storage.StorageClassDeviceSets {
-		if err := controller.CheckPodMemory(cephv1.ResourcesKeyPrepareOSD, storageClassDeviceSet.Resources, cephOsdPodMinimumMemory); err != nil {
+		if err := controller.CheckPodMemory(storageClassDeviceSet.Resources, cephOsdPodMinimumMemory); err != nil {
 			config.addError("cannot use storageClassDeviceSet %q for creating osds %v", storageClassDeviceSet.Name, err)
 			continue
 		}
@@ -76,7 +75,6 @@ func (c *Cluster) prepareStorageClassDeviceSets(config *provisionConfig) []rookv
 				Name:                storageClassDeviceSet.Name,
 				Resources:           storageClassDeviceSet.Resources,
 				Placement:           storageClassDeviceSet.Placement,
-				PreparePlacement:    storageClassDeviceSet.PreparePlacement,
 				Config:              storageClassDeviceSet.Config,
 				Size:                dataSize,
 				PVCSources:          pvcSources,
diff --git a/pkg/operator/ceph/cluster/osd/osd.go b/pkg/operator/ceph/cluster/osd/osd.go
index 7d85a9fc7..a327d369b 100644
--- a/pkg/operator/ceph/cluster/osd/osd.go
+++ b/pkg/operator/ceph/cluster/osd/osd.go
@@ -134,7 +134,6 @@ type osdProperties struct {
 	resources           v1.ResourceRequirements
 	storeConfig         osdconfig.StoreConfig
 	placement           rookv1.Placement
-	preparePlacement    *rookv1.Placement
 	metadataDevice      string
 	location            string
 	portable            bool
@@ -158,21 +157,12 @@ func (osdProps osdProperties) onPVCWithWal() bool {
 	return osdProps.walPVC.ClaimName != ""
 }
 
-func (osdProps osdProperties) getPreparePlacement() rookv1.Placement {
-	// If the osd prepare placement is specified, use it
-	if osdProps.preparePlacement != nil {
-		return *osdProps.preparePlacement
-	}
-	// Fall back to use the same placement as requested for the osd daemons
-	return osdProps.placement
-}
-
 // Start the osd management
 func (c *Cluster) Start() error {
 	config := c.newProvisionConfig()
 
 	// Validate pod's memory if specified
-	err := controller.CheckPodMemory(cephv1.ResourcesKeyOSD, cephv1.GetOSDResources(c.spec.Resources), cephOsdPodMinimumMemory)
+	err := controller.CheckPodMemory(cephv1.GetOSDResources(c.spec.Resources), cephOsdPodMinimumMemory)
 	if err != nil {
 		return errors.Wrap(err, "failed to check pod memory")
 	}
@@ -254,7 +244,6 @@ func (c *Cluster) startProvisioningOverPVCs(config *provisionConfig) {
 			walPVC:           walSource,
 			resources:        volume.Resources,
 			placement:        volume.Placement,
-			preparePlacement: volume.PreparePlacement,
 			portable:         volume.Portable,
 			crushDeviceClass: volume.CrushDeviceClass,
 			schedulerName:    volume.SchedulerName,
@@ -263,15 +252,18 @@ func (c *Cluster) startProvisioningOverPVCs(config *provisionConfig) {
 
 		logger.Debugf("osdProps are %+v", osdProps)
 
+		// If the deviceSet template has "encrypted" but the Ceph version is not compatible
 		if osdProps.encrypted {
-			// If the deviceSet template has "encrypted" but the Ceph version is not compatible
 			if !c.isCephVolumeRawModeSupported() {
 				errMsg := fmt.Sprintf("failed to validate storageClassDeviceSet %q. min required ceph version to support encryption is %q or %q", volume.Name, cephVolumeRawEncryptionModeMinNautilusCephVersion.String(), cephVolumeRawEncryptionModeMinOctopusCephVersion.String())
 				config.addError(errMsg)
 				continue
 			}
+		}
 
-			// create encryption Kubernetes Secret if the PVC is encrypted
+		// create encryption Kubernetes Secret if the PVC is encrypted
+		if osdProps.encrypted {
+			// Generate dmcrypt key
 			key, err := generateDmCryptKey()
 			if err != nil {
 				errMsg := fmt.Sprintf("failed to generate dmcrypt key for osd claim %q. %v", osdProps.pvc.ClaimName, err)
@@ -723,7 +715,6 @@ func (c *Cluster) getOSDPropsForPVC(pvcName string) (osdProperties, error) {
 				walPVC:              walSource,
 				resources:           volumeSource.Resources,
 				placement:           volumeSource.Placement,
-				preparePlacement:    volumeSource.PreparePlacement,
 				portable:            volumeSource.Portable,
 				tuneSlowDeviceClass: volumeSource.TuneSlowDeviceClass,
 				pvcSize:             volumeSource.Size,
diff --git a/pkg/operator/ceph/cluster/osd/provision_spec.go b/pkg/operator/ceph/cluster/osd/provision_spec.go
index 2b76e07c6..01d0138dd 100644
--- a/pkg/operator/ceph/cluster/osd/provision_spec.go
+++ b/pkg/operator/ceph/cluster/osd/provision_spec.go
@@ -72,22 +72,9 @@ func (c *Cluster) makeJob(osdProps osdProperties, provisionConfig *provisionConf
 	k8sutil.AddRookVersionLabelToJob(job)
 	controller.AddCephVersionLabelToJob(c.clusterInfo.CephVersion, job)
 	k8sutil.SetOwnerRef(&job.ObjectMeta, &c.clusterInfo.OwnerRef)
-
-	// override the resources of all the init containers and main container with the expected osd prepare resources
-	c.applyResourcesToAllContainers(&podSpec.Spec, cephv1.GetPrepareOSDResources(c.spec.Resources))
 	return job, nil
 }
 
-// applyResourcesToAllContainers applies consistent resource requests for all containers and all init containers in the pod
-func (c *Cluster) applyResourcesToAllContainers(spec *v1.PodSpec, resources v1.ResourceRequirements) {
-	for i := range spec.InitContainers {
-		spec.InitContainers[i].Resources = resources
-	}
-	for i := range spec.Containers {
-		spec.Containers[i].Resources = resources
-	}
-}
-
 func (c *Cluster) provisionPodTemplateSpec(osdProps osdProperties, restart v1.RestartPolicy, provisionConfig *provisionConfig) (*v1.PodTemplateSpec, error) {
 	copyBinariesVolume, copyBinariesContainer := c.getCopyBinariesContainer()
 
@@ -141,7 +128,7 @@ func (c *Cluster) provisionPodTemplateSpec(osdProps osdProperties, restart v1.Re
 	if !osdProps.onPVC() {
 		cephv1.GetOSDPlacement(c.spec.Placement).ApplyToPodSpec(&podSpec)
 	} else {
-		osdProps.getPreparePlacement().ApplyToPodSpec(&podSpec)
+		osdProps.placement.ApplyToPodSpec(&podSpec)
 	}
 
 	podMeta := metav1.ObjectMeta{
diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go
index 56110913a..647820ced 100644
--- a/pkg/operator/ceph/cluster/osd/spec.go
+++ b/pkg/operator/ceph/cluster/osd/spec.go
@@ -50,8 +50,6 @@ const (
 	blockPVCWalMapperInitContainer                = "blkdevmapper-wal"
 	activatePVCOSDInitContainer                   = "activate"
 	expandPVCOSDInitContainer                     = "expand-bluefs"
-	expandEncryptedPVCOSDInitContainer            = "expand-encrypted-bluefs"
-	encryptedPVCStatusOSDInitContainer            = "encrypted-block-status"
 	encryptionKeyFileName                         = "luks_key"
 	// DmcryptBlockType is a portion of the device mapper name for the encrypted OSD on PVC block.db (rocksdb db)
 	DmcryptBlockType = "block-dmcrypt"
@@ -112,22 +110,6 @@ else
 	ceph-volume "$CV_MODE" activate "${ARGS[@]}"
 fi
 
-`
-
-	openEncryptedBlock = `
-set -xe
-
-KEY_FILE_PATH=%s
-BLOCK_PATH=%s
-DM_NAME=%s
-DM_PATH=%s
-
-if [ -b "$DM_PATH" ]; then
-	echo "Encrypted device "$BLOCK_PATH" already opened at "$DM_PATH""
-else
-  echo "Opening encrypted device "$BLOCK_PATH" at "$DM_PATH""
-  cryptsetup luksOpen --verbose --allow-discards --key-file "$KEY_FILE_PATH" "$BLOCK_PATH" "$DM_NAME"
-fi
 `
 )
 
@@ -350,14 +332,9 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd OSDInfo, provisionC
 
 	if osdProps.onPVC() && osd.CVMode == "raw" {
 		if osdProps.encrypted {
-			// Open the encrypted disk
+			// Add a new init container to open the encrypted disk!
 			initContainers = append(initContainers, c.getPVCEncryptionOpenInitContainerActivate(osdProps)...)
-			// Copy the encrypted block to the osd data location, e,g: /var/lib/ceph/osd/ceph-0/block
 			initContainers = append(initContainers, c.getPVCEncryptionInitContainerActivate(osdDataDirPath, osdProps)...)
-			// Print the encrypted block status
-			initContainers = append(initContainers, c.getEncryptedStatusPVCInitContainer(osdDataDirPath, osdProps))
-			// Resize the encrypted device if necessary, this must be done after the encrypted block is opened
-			initContainers = append(initContainers, c.getExpandEncryptedPVCInitContainer(osdDataDirPath, osdProps))
 		} else {
 			initContainers = append(initContainers, c.getPVCInitContainerActivate(osdDataDirPath, osdProps))
 			if osdProps.onPVCWithMetadata() {
@@ -368,8 +345,10 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd OSDInfo, provisionC
 			}
 		}
 		initContainers = append(initContainers, c.getActivatePVCInitContainer(osdProps, osdID))
-		initContainers = append(initContainers, c.getExpandPVCInitContainer(osdProps, osdID))
-
+		// Expansion is not supported on encrypted device
+		if !osdProps.encrypted {
+			initContainers = append(initContainers, c.getExpandPVCInitContainer(osdProps, osdID))
+		}
 	}
 	if doActivateOSDInit {
 		initContainers = append(initContainers, *activateOSDContainer)
@@ -597,12 +576,18 @@ func (c *Cluster) generateEncryptionOpenBlockContainer(resources v1.ResourceRequ
 	return v1.Container{
 		Name:  containerName,
 		Image: c.spec.CephVersion.Image,
-		// Running via bash allows us to check whether the device is already opened or not
-		// If we don't the cryptsetup command will fail saying the device is already opened
 		Command: []string{
-			"/bin/bash",
-			"-c",
-			fmt.Sprintf(openEncryptedBlock, encryptionKeyPath(), fmt.Sprintf("/%s", pvcName), encryptionDMName(pvcName, blockType), encryptionDMPath(pvcName, blockType)),
+			"cryptsetup",
+		},
+		// Runs "cryptsetup --verbose --key-file /etc/ceph/luks_key --allow-discards luksOpen /set1-data-0-7dwll set1-data-0-7dwll-block-dmcrypt"
+		Args: []string{
+			"--verbose",
+			"--key-file",
+			encryptionKeyPath(),
+			"--allow-discards",
+			"luksOpen",
+			fmt.Sprintf("/%s", pvcName),
+			encryptionDMName(pvcName, blockType),
 		},
 		VolumeDevices: []v1.VolumeDevice{
 			{
@@ -803,19 +788,9 @@ func (c *Cluster) getActivatePVCInitContainer(osdProps osdProperties, osdID stri
 }
 
 func (c *Cluster) getExpandPVCInitContainer(osdProps osdProperties, osdID string) v1.Container {
-	/* Output example from 10GiB to 20GiB:
-
-	   inferring bluefs devices from bluestore path
-	   1 : device size 0x4ffe00000 : own 0x[11ff00000~40000000] = 0x40000000 : using 0x470000(4.4 MiB) : bluestore has 0x23fdd0000(9.0 GiB) available
-	   Expanding DB/WAL...
-	   Expanding Main...
-	   1 : expanding  from 0x27fe00000 to 0x4ffe00000
-	   1 : size label updated to 21472739328
-
-	*/
 	osdDataPath := activateOSDMountPath + osdID
 
-	return v1.Container{
+	container := v1.Container{
 		Name:  expandPVCOSDInitContainer,
 		Image: c.spec.CephVersion.Image,
 		Command: []string{
@@ -826,53 +801,6 @@ func (c *Cluster) getExpandPVCInitContainer(osdProps osdProperties, osdID string
 		SecurityContext: PrivilegedContext(),
 		Resources:       osdProps.resources,
 	}
-}
-
-func (c *Cluster) getExpandEncryptedPVCInitContainer(mountPath string, osdProps osdProperties) v1.Container {
-	/* Command example
-	   [root@rook-ceph-osd-0-59b9947547-w8mdq /]# cryptsetup resize set1-data-2-8n462-block-dmcrypt
-	   Command successful.
-	*/
 
-	return v1.Container{
-		Name:  expandEncryptedPVCOSDInitContainer,
-		Image: c.spec.CephVersion.Image,
-		Command: []string{
-			"cryptsetup",
-		},
-		Args:            []string{"--verbose", "resize", encryptionDMName(osdProps.pvc.ClaimName, DmcryptBlockType)},
-		VolumeMounts:    []v1.VolumeMount{getPvcOSDBridgeMountActivate(mountPath, osdProps.pvc.ClaimName)},
-		SecurityContext: PrivilegedContext(),
-		Resources:       osdProps.resources,
-	}
-}
-
-func (c *Cluster) getEncryptedStatusPVCInitContainer(mountPath string, osdProps osdProperties) v1.Container {
-	/* Command example:
-		root@rook-ceph-osd-0-59b9947547-w8mdq /]# cryptsetup status set1-data-2-8n462-block-dmcrypt -v
-	   /dev/mapper/set1-data-2-8n462-block-dmcrypt is active and is in use.
-	     type:    LUKS1
-	     cipher:  aes-xts-plain64
-	     keysize: 256 bits
-	     key location: dm-crypt
-	     device:  /dev/xvdbv
-	     sector size:  512
-	     offset:  4096 sectors
-	     size:    20967424 sectors
-	     mode:    read/write
-	     flags:   discards
-	   Command successful.
-	*/
-
-	return v1.Container{
-		Name:  encryptedPVCStatusOSDInitContainer,
-		Image: c.spec.CephVersion.Image,
-		Command: []string{
-			"cryptsetup",
-		},
-		Args:            []string{"--verbose", "status", encryptionDMName(osdProps.pvc.ClaimName, DmcryptBlockType)},
-		VolumeMounts:    []v1.VolumeMount{getPvcOSDBridgeMountActivate(mountPath, osdProps.pvc.ClaimName)},
-		SecurityContext: PrivilegedContext(),
-		Resources:       osdProps.resources,
-	}
+	return container
 }
diff --git a/pkg/operator/ceph/cluster/rbd/mirror.go b/pkg/operator/ceph/cluster/rbd/mirror.go
index 429b6e574..a8ddc5d7b 100644
--- a/pkg/operator/ceph/cluster/rbd/mirror.go
+++ b/pkg/operator/ceph/cluster/rbd/mirror.go
@@ -45,7 +45,7 @@ var updateDeploymentAndWait = mon.UpdateCephDeploymentAndWait
 // Start begins the process of running rbd mirroring daemons.
 func (r *ReconcileCephRBDMirror) start(cephRBDMirror *cephv1.CephRBDMirror) error {
 	// Validate pod's memory if specified
-	err := controller.CheckPodMemory(cephv1.ResourcesKeyRBDMirror, cephRBDMirror.Spec.Resources, cephRbdMirrorPodMinimumMemory)
+	err := controller.CheckPodMemory(cephRBDMirror.Spec.Resources, cephRbdMirrorPodMinimumMemory)
 	if err != nil {
 		return errors.Wrap(err, "error checking pod memory")
 	}
diff --git a/pkg/operator/ceph/controller/spec.go b/pkg/operator/ceph/controller/spec.go
index 2a071c6d4..e48f0d3a1 100644
--- a/pkg/operator/ceph/controller/spec.go
+++ b/pkg/operator/ceph/controller/spec.go
@@ -324,10 +324,11 @@ func CephDaemonAppLabels(appName, namespace, daemonType, daemonID string, includ
 }
 
 // CheckPodMemory verify pod's memory limit is valid
-func CheckPodMemory(name string, resources v1.ResourceRequirements, cephPodMinimumMemory uint64) error {
+func CheckPodMemory(resources v1.ResourceRequirements, cephPodMinimumMemory uint64) error {
 	// Ceph related PR: https://github.com/ceph/ceph/pull/26856
 	podMemoryLimit := resources.Limits.Memory()
 	podMemoryRequest := resources.Requests.Memory()
+	errorMessage := `refuse to run the pod with %dmb of ram, provide at least %dmb.`
 
 	// If nothing was provided let's just return
 	// This means no restrictions on pod's resources
@@ -338,8 +339,7 @@ func CheckPodMemory(name string, resources v1.ResourceRequirements, cephPodMinim
 	if !podMemoryLimit.IsZero() {
 		// This means LIMIT and REQUEST are either identical or different but still we use LIMIT as a reference
 		if uint64(podMemoryLimit.Value()) < display.MbTob(cephPodMinimumMemory) {
-			// allow the configuration if less than the min, but print a warning
-			logger.Warningf("running the %q daemon(s) with %dmb of ram, but at least %dmb is recommended", name, display.BToMb(uint64(podMemoryLimit.Value())), cephPodMinimumMemory)
+			return errors.Errorf(errorMessage, display.BToMb(uint64(podMemoryLimit.Value())), cephPodMinimumMemory)
 		}
 
 		// This means LIMIT < REQUEST
diff --git a/pkg/operator/ceph/csi/csi.go b/pkg/operator/ceph/csi/csi.go
index b65e9fe5a..b0a58cd3d 100644
--- a/pkg/operator/ceph/csi/csi.go
+++ b/pkg/operator/ceph/csi/csi.go
@@ -20,7 +20,6 @@ import (
 	"strconv"
 
 	"github.com/pkg/errors"
-	rookclient "github.com/rook/rook/pkg/client/clientset/versioned"
 	controllerutil "github.com/rook/rook/pkg/operator/ceph/controller"
 	"github.com/rook/rook/pkg/operator/k8sutil"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -28,7 +27,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 )
 
-func ValidateAndConfigureDrivers(clientset kubernetes.Interface, rookclientset rookclient.Interface, namespace, rookImage, securityAccount string, serverVersion *version.Info, ownerRef *metav1.OwnerReference) {
+func ValidateAndConfigureDrivers(clientset kubernetes.Interface, namespace, rookImage, securityAccount string, serverVersion *version.Info, ownerRef *metav1.OwnerReference) {
 	if !AllowUnsupported {
 		if err := validateCSIVersion(clientset, namespace, rookImage, securityAccount, ownerRef); err != nil {
 			logger.Errorf("invalid csi version. %+v", err)
@@ -38,7 +37,7 @@ func ValidateAndConfigureDrivers(clientset kubernetes.Interface, rookclientset r
 		logger.Info("Skipping csi version check, since unsupported versions are allowed")
 	}
 
-	if err := startDrivers(clientset, rookclientset, namespace, serverVersion, ownerRef); err != nil {
+	if err := startDrivers(clientset, namespace, serverVersion, ownerRef); err != nil {
 		logger.Errorf("failed to start Ceph csi drivers. %v", err)
 		return
 	}
diff --git a/pkg/operator/ceph/csi/spec.go b/pkg/operator/ceph/csi/spec.go
index 5b5a33327..000a875bc 100644
--- a/pkg/operator/ceph/csi/spec.go
+++ b/pkg/operator/ceph/csi/spec.go
@@ -22,7 +22,6 @@ import (
 	"strings"
 	"time"
 
-	rookclient "github.com/rook/rook/pkg/client/clientset/versioned"
 	controllerutil "github.com/rook/rook/pkg/operator/ceph/controller"
 	"github.com/rook/rook/pkg/operator/k8sutil"
 	"github.com/rook/rook/pkg/operator/k8sutil/cmdreporter"
@@ -199,7 +198,7 @@ func ValidateCSIParam() error {
 	return nil
 }
 
-func startDrivers(clientset kubernetes.Interface, rookclientset rookclient.Interface, namespace string, ver *version.Info, ownerRef *metav1.OwnerReference) error {
+func startDrivers(clientset kubernetes.Interface, namespace string, ver *version.Info, ownerRef *metav1.OwnerReference) error {
 	var (
 		err                                                   error
 		rbdPlugin, cephfsPlugin                               *apps.DaemonSet
@@ -362,13 +361,6 @@ func startDrivers(clientset kubernetes.Interface, rookclientset rookclient.Inter
 		// apply resource request and limit to rbdplugin containers
 		applyResourcesToContainers(clientset, rbdPluginResource, &rbdPlugin.Spec.Template.Spec)
 		k8sutil.SetOwnerRef(&rbdPlugin.ObjectMeta, ownerRef)
-		multusApplied, err := applyCephClusterNetworkConfig(&rbdPlugin.Spec.Template.ObjectMeta, rookclientset)
-		if err != nil {
-			return errors.Wrapf(err, "failed to apply network config to rbd plugin daemonset: %+v", rbdPlugin)
-		}
-		if multusApplied {
-			rbdPlugin.Spec.Template.Spec.HostNetwork = false
-		}
 		err = k8sutil.CreateDaemonSet(csiRBDPlugin, namespace, clientset, rbdPlugin)
 		if err != nil {
 			return errors.Wrapf(err, "failed to start rbdplugin daemonset: %+v", rbdPlugin)
@@ -387,10 +379,6 @@ func startDrivers(clientset kubernetes.Interface, rookclientset rookclient.Inter
 			Type: apps.RecreateDeploymentStrategyType,
 		}
 
-		_, err = applyCephClusterNetworkConfig(&rbdProvisionerDeployment.Spec.Template.ObjectMeta, rookclientset)
-		if err != nil {
-			return errors.Wrapf(err, "failed to apply network config to rbd plugin provisioner deployment: %+v", rbdProvisionerDeployment)
-		}
 		err = k8sutil.CreateDeployment(clientset, csiRBDProvisioner, namespace, rbdProvisionerDeployment)
 		if err != nil {
 			return errors.Wrapf(err, "failed to start rbd provisioner deployment: %+v", rbdProvisionerDeployment)
@@ -411,13 +399,6 @@ func startDrivers(clientset kubernetes.Interface, rookclientset rookclient.Inter
 		// apply resource request and limit to cephfs plugin containers
 		applyResourcesToContainers(clientset, cephFSPluginResource, &cephfsPlugin.Spec.Template.Spec)
 		k8sutil.SetOwnerRef(&cephfsPlugin.ObjectMeta, ownerRef)
-		multusApplied, err := applyCephClusterNetworkConfig(&cephfsPlugin.Spec.Template.ObjectMeta, rookclientset)
-		if err != nil {
-			return errors.Wrapf(err, "failed to apply network config to cephfs plugin daemonset: %+v", cephfsPlugin)
-		}
-		if multusApplied {
-			cephfsPlugin.Spec.Template.Spec.HostNetwork = false
-		}
 		err = k8sutil.CreateDaemonSet(csiCephFSPlugin, namespace, clientset, cephfsPlugin)
 		if err != nil {
 			return errors.Wrapf(err, "failed to start cephfs plugin daemonset: %+v", cephfsPlugin)
@@ -436,11 +417,6 @@ func startDrivers(clientset kubernetes.Interface, rookclientset rookclient.Inter
 		cephfsProvisionerDeployment.Spec.Strategy = apps.DeploymentStrategy{
 			Type: apps.RecreateDeploymentStrategyType,
 		}
-
-		_, err = applyCephClusterNetworkConfig(&cephfsProvisionerDeployment.Spec.Template.ObjectMeta, rookclientset)
-		if err != nil {
-			return errors.Wrapf(err, "failed to apply network config to cephfs plugin provisioner deployment: %+v", cephfsProvisionerDeployment)
-		}
 		err = k8sutil.CreateDeployment(clientset, csiCephFSProvisioner, namespace, cephfsProvisionerDeployment)
 		if err != nil {
 			return errors.Wrapf(err, "failed to start cephfs provisioner deployment: %+v", cephfsProvisionerDeployment)
@@ -522,23 +498,6 @@ func deleteCSIDriverResources(
 	return succeeded
 }
 
-func applyCephClusterNetworkConfig(objectMeta *metav1.ObjectMeta, rookclientset rookclient.Interface) (bool, error) {
-	cephClusters, err := rookclientset.CephV1().CephClusters(objectMeta.Namespace).List(metav1.ListOptions{})
-	if err != nil {
-		return false, errors.Errorf("failed to find CephClusters in namespace %q", objectMeta.Namespace)
-	}
-	for _, cephCluster := range cephClusters.Items {
-		if cephCluster.Spec.Network.IsMultus() {
-			err = k8sutil.ApplyMultus(cephCluster.Spec.Network.NetworkSpec, objectMeta)
-			if err != nil {
-				return false, errors.Wrapf(err, "failed to apply multus configuration to CephCluster %q", cephCluster.Name)
-			}
-		}
-	}
-
-	return true, nil
-}
-
 // createCSIDriverInfo Registers CSI driver by creating a CSIDriver object
 func createCSIDriverInfo(clientset kubernetes.Interface, name string, ownerRef *metav1.OwnerReference) error {
 	attach := true
diff --git a/pkg/operator/ceph/file/mds/mds.go b/pkg/operator/ceph/file/mds/mds.go
index 746b13b4c..21f8eb7ee 100644
--- a/pkg/operator/ceph/file/mds/mds.go
+++ b/pkg/operator/ceph/file/mds/mds.go
@@ -102,7 +102,7 @@ var UpdateDeploymentAndWait = mon.UpdateCephDeploymentAndWait
 // Start starts or updates a Ceph mds cluster in Kubernetes.
 func (c *Cluster) Start() error {
 	// Validate pod's memory if specified
-	err := controller.CheckPodMemory(cephv1.ResourcesKeyMDS, c.fs.Spec.MetadataServer.Resources, cephMdsPodMinimumMemory)
+	err := controller.CheckPodMemory(c.fs.Spec.MetadataServer.Resources, cephMdsPodMinimumMemory)
 	if err != nil {
 		return errors.Wrap(err, "error checking pod memory")
 	}
diff --git a/pkg/operator/ceph/object/bucket/provisioner.go b/pkg/operator/ceph/object/bucket/provisioner.go
index 37fb796bc..05b260203 100644
--- a/pkg/operator/ceph/object/bucket/provisioner.go
+++ b/pkg/operator/ceph/object/bucket/provisioner.go
@@ -311,7 +311,7 @@ func (p Provisioner) Revoke(ob *bktv1alpha1.ObjectBucket) error {
 // initializeCreateOrGrant sets common provisioner receiver fields and
 // the services and sessions needed to provision.
 func (p *Provisioner) initializeCreateOrGrant(options *apibkt.BucketOptions) error {
-	logger.Info("initializing and setting CreateOrGrant services")
+	logger.Infof("initializing and setting CreateOrGrant services")
 
 	// set the bucket name
 	obc := options.ObjectBucketClaim
diff --git a/pkg/operator/ceph/object/health.go b/pkg/operator/ceph/object/health.go
index 5f702b3dc..02207e942 100644
--- a/pkg/operator/ceph/object/health.go
+++ b/pkg/operator/ceph/object/health.go
@@ -168,7 +168,7 @@ func (c *bucketChecker) checkObjectStoreHealth() error {
 		return errors.Wrapf(err, "failed to run bucket health checks for object store %q", c.namespacedName.Name)
 	}
 
-	logger.Debugf("successfully checked object store endpoint for object store %q", c.namespacedName.Name)
+	logger.Debug("successfully checked object store endpoint for object store %q", c.namespacedName.Name)
 
 	// Update the EndpointStatus in the CR to reflect the healthyness
 	updateStatusBucket(c.client, c.namespacedName, cephv1.ConditionConnected, "")
diff --git a/pkg/operator/ceph/object/objectstore.go b/pkg/operator/ceph/object/objectstore.go
index 4bd89fddd..ae6b23618 100644
--- a/pkg/operator/ceph/object/objectstore.go
+++ b/pkg/operator/ceph/object/objectstore.go
@@ -699,7 +699,7 @@ func GetObjectBucketProvisioner(c *clusterd.Context, namespace string) string {
 	provName := bucketProvisionerName
 	obcWatchOnNamespace, err := k8sutil.GetOperatorSetting(c.Clientset, opcontroller.OperatorSettingConfigMapName, "ROOK_OBC_WATCH_OPERATOR_NAMESPACE", "false")
 	if err != nil {
-		logger.Warning("failed to verify if obc should watch the operator namespace or all of them, watching all")
+		logger.Warningf("failed to verify if obc should watch the operator namespace or all of them, watching all")
 	} else {
 		if strings.EqualFold(obcWatchOnNamespace, "true") {
 			provName = fmt.Sprintf("%s.%s", namespace, bucketProvisionerName)
diff --git a/pkg/operator/ceph/object/rgw.go b/pkg/operator/ceph/object/rgw.go
index dd0764031..12f41de99 100644
--- a/pkg/operator/ceph/object/rgw.go
+++ b/pkg/operator/ceph/object/rgw.go
@@ -91,7 +91,7 @@ func (c *clusterConfig) startRGWPods(realmName, zoneGroupName, zoneName string)
 	}
 	if c.store.Spec.Gateway.Instances < 1 {
 		// Set the minimum of at least one instance
-		logger.Warning("spec.gateway.instances must be set to at least 1")
+		logger.Warningf("spec.gateway.instances must be set to at least 1")
 		c.store.Spec.Gateway.Instances = 1
 	}
 
@@ -182,7 +182,7 @@ func (c *clusterConfig) startRGWPods(realmName, zoneGroupName, zoneName string)
 	// scale down scenario
 	deps, err := k8sutil.GetDeployments(c.context.Clientset, c.store.Namespace, c.storeLabelSelector())
 	if err != nil {
-		logger.Warningf("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
+		logger.Warning("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
 	}
 
 	currentRgwInstances := int(len(deps.Items))
@@ -213,7 +213,7 @@ func (c *clusterConfig) startRGWPods(realmName, zoneGroupName, zoneName string)
 		// verify scale down was successful
 		deps, err = k8sutil.GetDeployments(c.context.Clientset, c.store.Namespace, c.storeLabelSelector())
 		if err != nil {
-			logger.Warningf("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
+			logger.Warning("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
 		}
 		currentRgwInstances = len(deps.Items)
 		if currentRgwInstances == desiredRgwInstances {
@@ -251,7 +251,7 @@ func (c *clusterConfig) deleteLegacyDaemons() {
 	logger.Debugf("looking for legacy deployment in object store %q", c.store.Name)
 	deps, err := k8sutil.GetDeployments(c.context.Clientset, c.store.Namespace, c.storeLabelSelector())
 	if err != nil {
-		logger.Warningf("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
+		logger.Warning("could not get deployments for object store %q (matching label selector %q). %v", c.store.Name, c.storeLabelSelector(), err)
 	}
 	for _, d := range deps.Items {
 		if d.Name == instanceName(c.store.Name) {
diff --git a/pkg/operator/ceph/operator.go b/pkg/operator/ceph/operator.go
index 5b21fbb3c..0cbe566b5 100644
--- a/pkg/operator/ceph/operator.go
+++ b/pkg/operator/ceph/operator.go
@@ -251,7 +251,7 @@ func (o *Operator) updateDrivers() error {
 		return errors.Wrap(err, "invalid csi params")
 	}
 
-	go csi.ValidateAndConfigureDrivers(o.context.Clientset, o.context.RookClientset, o.operatorNamespace, o.rookImage, o.securityAccount, serverVersion, ownerRef)
+	go csi.ValidateAndConfigureDrivers(o.context.Clientset, o.operatorNamespace, o.rookImage, o.securityAccount, serverVersion, ownerRef)
 	return nil
 }
 
diff --git a/pkg/operator/k8sutil/network.go b/pkg/operator/k8sutil/network.go
index ba6584419..0eb62860b 100644
--- a/pkg/operator/k8sutil/network.go
+++ b/pkg/operator/k8sutil/network.go
@@ -26,11 +26,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-const (
-	// publicNetworkSelectorKeyName is the network selector key for the ceph public network
-	publicNetworkSelectorKeyName = "public"
-)
-
 // NetworkAttachmentConfig represents the configuration of the NetworkAttachmentDefinitions object
 type NetworkAttachmentConfig struct {
 	CniVersion string `json:"cniVersion"`
@@ -115,7 +110,7 @@ func ApplyMultus(net rookv1.NetworkSpec, objectMeta *metav1.ObjectMeta) error {
 	shortSyntax := false
 	jsonSyntax := false
 
-	for k, ns := range net.Selectors {
+	for _, ns := range net.Selectors {
 		var multusMap map[string]string
 		err := json.Unmarshal([]byte(ns), &multusMap)
 
@@ -125,14 +120,7 @@ func ApplyMultus(net rookv1.NetworkSpec, objectMeta *metav1.ObjectMeta) error {
 			shortSyntax = true
 		}
 
-		isCsi := strings.Contains(objectMeta.Labels["app"], "csi-")
-		if isCsi {
-			if k == publicNetworkSelectorKeyName {
-				v = append(v, string(ns))
-			}
-		} else {
-			v = append(v, string(ns))
-		}
+		v = append(v, string(ns))
 	}
 
 	if shortSyntax && jsonSyntax {


Test patch:
diff --git a/pkg/operator/ceph/cluster/mon/node_test.go b/pkg/operator/ceph/cluster/mon/node_test.go
index eb031885e..6ae072080 100644
--- a/pkg/operator/ceph/cluster/mon/node_test.go
+++ b/pkg/operator/ceph/cluster/mon/node_test.go
@@ -74,7 +74,7 @@ func TestNodeAffinity(t *testing.T) {
 func TestHostNetworkSameNode(t *testing.T) {
 	namespace := "ns"
 	context, err := newTestStartCluster(t, namespace)
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 	// cluster host networking
 	c := newCluster(context, namespace, true, v1.ResourceRequirements{})
 	c.spec.Network.HostNetwork = true
@@ -88,7 +88,7 @@ func TestHostNetworkSameNode(t *testing.T) {
 func TestPodMemory(t *testing.T) {
 	namespace := "ns"
 	context, err := newTestStartCluster(t, namespace)
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 	// Test memory limit alone
 	r := v1.ResourceRequirements{
 		Limits: v1.ResourceList{
@@ -100,7 +100,7 @@ func TestPodMemory(t *testing.T) {
 	c.ClusterInfo = clienttest.CreateTestClusterInfo(1)
 	// start a basic cluster
 	_, err = c.Start(c.ClusterInfo, c.rookVersion, cephver.Nautilus, c.spec)
-	assert.NoError(t, err)
+	assert.Error(t, err)
 
 	// Test REQUEST == LIMIT
 	r = v1.ResourceRequirements{
@@ -116,7 +116,7 @@ func TestPodMemory(t *testing.T) {
 	c.ClusterInfo = clienttest.CreateTestClusterInfo(1)
 	// start a basic cluster
 	_, err = c.Start(c.ClusterInfo, c.rookVersion, cephver.Nautilus, c.spec)
-	assert.NoError(t, err)
+	assert.Error(t, err)
 
 	// Test LIMIT != REQUEST but obviously LIMIT > REQUEST
 	r = v1.ResourceRequirements{
@@ -132,9 +132,9 @@ func TestPodMemory(t *testing.T) {
 	c.ClusterInfo = clienttest.CreateTestClusterInfo(1)
 	// start a basic cluster
 	_, err = c.Start(c.ClusterInfo, c.rookVersion, cephver.Nautilus, c.spec)
-	assert.NoError(t, err)
+	assert.Error(t, err)
 
-	// Test valid case where pod resource is set appropriately
+	// Test valid case where pod resource is set approprietly
 	r = v1.ResourceRequirements{
 		Limits: v1.ResourceList{
 			v1.ResourceMemory: *resource.NewQuantity(1073741824, resource.BinarySI), // size in Bytes
@@ -148,7 +148,7 @@ func TestPodMemory(t *testing.T) {
 	c.ClusterInfo = clienttest.CreateTestClusterInfo(1)
 	// start a basic cluster
 	_, err = c.Start(c.ClusterInfo, c.rookVersion, cephver.Nautilus, c.spec)
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 
 	// Test no resources were specified on the pod
 	r = v1.ResourceRequirements{}
@@ -156,7 +156,7 @@ func TestPodMemory(t *testing.T) {
 	c.ClusterInfo = clienttest.CreateTestClusterInfo(1)
 	// start a basic cluster
 	_, err = c.Start(c.ClusterInfo, c.rookVersion, cephver.Nautilus, c.spec)
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 
 }
 
@@ -203,7 +203,7 @@ func extractArgValue(args []string, name string) (string, string) {
 func TestGetNodeInfoFromNode(t *testing.T) {
 	clientset := test.New(t, 1)
 	node, err := clientset.CoreV1().Nodes().Get("node0", metav1.GetOptions{})
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 	assert.NotNil(t, node)
 
 	node.Status = v1.NodeStatus{}
@@ -221,6 +221,6 @@ func TestGetNodeInfoFromNode(t *testing.T) {
 	node.Status.Addresses[0].Type = v1.NodeInternalIP
 	node.Status.Addresses[0].Address = "172.17.0.1"
 	info, err = getNodeInfoFromNode(*node)
-	assert.NoError(t, err)
+	assert.Nil(t, err)
 	assert.Equal(t, "172.17.0.1", info.Address)
 }
diff --git a/pkg/operator/ceph/cluster/osd/osd_test.go b/pkg/operator/ceph/cluster/osd/osd_test.go
index e356e2899..dcc89df6c 100644
--- a/pkg/operator/ceph/cluster/osd/osd_test.go
+++ b/pkg/operator/ceph/cluster/osd/osd_test.go
@@ -404,53 +404,3 @@ func TestGetOSDInfo(t *testing.T) {
 	assert.Equal(t, 0, len(osds3))
 	assert.NotNil(t, err)
 }
-
-func TestOSDPlacement(t *testing.T) {
-	// no placement
-	prop := osdProperties{}
-	result := prop.getPreparePlacement()
-	assert.Nil(t, result.NodeAffinity)
-
-	// the osd daemon placement is specified
-	prop.placement = rookv1.Placement{NodeAffinity: &v1.NodeAffinity{
-		RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-			NodeSelectorTerms: []v1.NodeSelectorTerm{
-				{
-					MatchExpressions: []v1.NodeSelectorRequirement{
-						{
-							Key:      "label1",
-							Operator: v1.NodeSelectorOpIn,
-							Values:   []string{"bar", "baz"},
-						},
-					},
-				},
-			},
-		},
-	},
-	}
-
-	result = prop.getPreparePlacement()
-	assert.Equal(t, 1, len(result.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms))
-	assert.Equal(t, "label1", result.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms[0].MatchExpressions[0].Key)
-
-	// The prepare placement is specified and takes precedence over the osd placement
-	prop.preparePlacement = &rookv1.Placement{NodeAffinity: &v1.NodeAffinity{
-		RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-			NodeSelectorTerms: []v1.NodeSelectorTerm{
-				{
-					MatchExpressions: []v1.NodeSelectorRequirement{
-						{
-							Key:      "label2",
-							Operator: v1.NodeSelectorOpIn,
-							Values:   []string{"foo", "bar"},
-						},
-					},
-				},
-			},
-		},
-	},
-	}
-	result = prop.getPreparePlacement()
-	assert.Equal(t, 1, len(result.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms))
-	assert.Equal(t, "label2", result.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms[0].MatchExpressions[0].Key)
-}
diff --git a/pkg/operator/ceph/cluster/osd/spec_test.go b/pkg/operator/ceph/cluster/osd/spec_test.go
index 3b261ac58..87103b578 100644
--- a/pkg/operator/ceph/cluster/osd/spec_test.go
+++ b/pkg/operator/ceph/cluster/osd/spec_test.go
@@ -205,77 +205,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 6, len(cont.VolumeMounts), cont.VolumeMounts)
 
-	// Test with encrypted OSD on PVC with RAW
-	osdProp.encrypted = true
-	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
-	assert.Nil(t, err)
-	assert.NotNil(t, deployment)
-	assert.Equal(t, 7, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[0].Name)
-	assert.Equal(t, "blkdevmapper-encryption", deployment.Spec.Template.Spec.InitContainers[1].Name)
-	assert.Equal(t, "encrypted-block-status", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[5].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[6].Name)
-	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
-	cont = deployment.Spec.Template.Spec.Containers[0]
-	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
-	osdProp.encrypted = false
-
-	// // Test OSD on PVC with RAW and metadata device
-	osd = OSDInfo{
-		ID:     0,
-		CVMode: "raw",
-	}
-	osdProp.metadataPVC = v1.PersistentVolumeClaimVolumeSource{ClaimName: "mypvc-metadata"}
-	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
-	assert.Nil(t, err)
-	assert.NotNil(t, deployment)
-	assert.Equal(t, 5, len(deployment.Spec.Template.Spec.InitContainers))
-	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
-	assert.Equal(t, "blkdevmapper-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
-	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
-	cont = deployment.Spec.Template.Spec.Containers[0]
-	assert.Equal(t, 6, len(cont.VolumeMounts), cont.VolumeMounts)
-	blkInitCont = deployment.Spec.Template.Spec.InitContainers[1]
-	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
-	blkMetaInitCont := deployment.Spec.Template.Spec.InitContainers[2]
-	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-
-	// // Test encrypted OSD on PVC with RAW and metadata device
-	osd = OSDInfo{
-		ID:     0,
-		CVMode: "raw",
-	}
-	osdProp.encrypted = true
-	osdProp.metadataPVC = v1.PersistentVolumeClaimVolumeSource{ClaimName: "mypvc-metadata"}
-	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
-	assert.Nil(t, err)
-	assert.NotNil(t, deployment)
-	assert.Equal(t, 9, len(deployment.Spec.Template.Spec.InitContainers))
-	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[0].Name)
-	assert.Equal(t, "encryption-open-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
-	assert.Equal(t, "blkdevmapper-encryption", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "blkdevmapper-metadata-encryption", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "encrypted-block-status", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[5].Name)
-	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[6].Name)
-	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[7].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[8].Name)
-	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
-	cont = deployment.Spec.Template.Spec.Containers[0]
-	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
-	blkInitCont = deployment.Spec.Template.Spec.InitContainers[1]
-	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
-	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[6]
-	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-	osdProp.encrypted = false
-
-	// // Test OSD on PVC with RAW / metadata and wal device
+	// Test OSD on PVC with RAW and metadata device
 	osd = OSDInfo{
 		ID:     0,
 		CVMode: "raw",
@@ -297,38 +227,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, 6, len(cont.VolumeMounts), cont.VolumeMounts)
 	blkInitCont = deployment.Spec.Template.Spec.InitContainers[1]
 	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
-	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[2]
-	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-
-	// // Test encrypted OSD on PVC with RAW / metadata and wal device
-	osd = OSDInfo{
-		ID:     0,
-		CVMode: "raw",
-	}
-	osdProp.encrypted = true
-	osdProp.metadataPVC = v1.PersistentVolumeClaimVolumeSource{ClaimName: "mypvc-metadata"}
-	osdProp.walPVC = v1.PersistentVolumeClaimVolumeSource{ClaimName: "mypvc-wal"}
-	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
-	assert.Nil(t, err)
-	assert.NotNil(t, deployment)
-	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.InitContainers))
-	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[0].Name)
-	assert.Equal(t, "encryption-open-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
-	assert.Equal(t, "encryption-open-wal", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "blkdevmapper-encryption", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "blkdevmapper-metadata-encryption", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, "blkdevmapper-wal-encryption", deployment.Spec.Template.Spec.InitContainers[5].Name)
-	assert.Equal(t, "encrypted-block-status", deployment.Spec.Template.Spec.InitContainers[6].Name)
-	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[7].Name)
-	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[8].Name)
-	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[9].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[10].Name)
-	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
-	cont = deployment.Spec.Template.Spec.Containers[0]
-	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
-	blkInitCont = deployment.Spec.Template.Spec.InitContainers[1]
-	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
-	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[8]
+	blkMetaInitCont := deployment.Spec.Template.Spec.InitContainers[2]
 	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
 }
 
diff --git a/pkg/operator/ceph/controller/spec_test.go b/pkg/operator/ceph/controller/spec_test.go
index 6d637c05b..153777181 100644
--- a/pkg/operator/ceph/controller/spec_test.go
+++ b/pkg/operator/ceph/controller/spec_test.go
@@ -66,7 +66,6 @@ func TestMountsMatchVolumes(t *testing.T) {
 func TestCheckPodMemory(t *testing.T) {
 	// This value is in MB
 	const PodMinimumMemory uint64 = 1024
-	name := "test"
 
 	// A value for the memory used in the tests
 	var memory_value = int64(PodMinimumMemory * 8 * uint64(math.Pow10(6)))
@@ -74,7 +73,7 @@ func TestCheckPodMemory(t *testing.T) {
 	// Case 1: No memory limits, no memory requested
 	test_resource := v1.ResourceRequirements{}
 
-	if err := CheckPodMemory(name, test_resource, PodMinimumMemory); err != nil {
+	if err := CheckPodMemory(test_resource, PodMinimumMemory); err != nil {
 		t.Errorf("Error case 1: %s", err.Error())
 	}
 
@@ -88,7 +87,7 @@ func TestCheckPodMemory(t *testing.T) {
 		},
 	}
 
-	if err := CheckPodMemory(name, test_resource, PodMinimumMemory); err != nil {
+	if err := CheckPodMemory(test_resource, PodMinimumMemory); err != nil {
 		t.Errorf("Error case 2: %s", err.Error())
 	}
 
@@ -99,7 +98,7 @@ func TestCheckPodMemory(t *testing.T) {
 		},
 	}
 
-	if err := CheckPodMemory(name, test_resource, PodMinimumMemory); err != nil {
+	if err := CheckPodMemory(test_resource, PodMinimumMemory); err != nil {
 		t.Errorf("Error case 3: %s", err.Error())
 	}
 }
diff --git a/pkg/operator/ceph/csi/spec_test.go b/pkg/operator/ceph/csi/spec_test.go
index 491386f06..7d389c30d 100644
--- a/pkg/operator/ceph/csi/spec_test.go
+++ b/pkg/operator/ceph/csi/spec_test.go
@@ -19,7 +19,6 @@ package csi
 import (
 	"testing"
 
-	rookclient "github.com/rook/rook/pkg/client/clientset/versioned"
 	"github.com/rook/rook/pkg/operator/test"
 
 	"github.com/stretchr/testify/assert"
@@ -39,11 +38,10 @@ func TestStartCSI(t *testing.T) {
 		SnapshotterImage: "image",
 	}
 	clientset := test.New(t, 3)
-	var rookclientset rookclient.Interface
 	serverVersion, err := clientset.Discovery().ServerVersion()
 	if err != nil {
 		assert.Nil(t, err)
 	}
-	err = startDrivers(clientset, rookclientset, "ns", serverVersion, nil)
+	err = startDrivers(clientset, "ns", serverVersion, nil)
 	assert.Nil(t, err)
 }
diff --git a/tests/framework/installer/ceph_installer.go b/tests/framework/installer/ceph_installer.go
index 0a51dffe3..197a44394 100644
--- a/tests/framework/installer/ceph_installer.go
+++ b/tests/framework/installer/ceph_installer.go
@@ -606,39 +606,39 @@ func (h *CephInstaller) UninstallRookFromMultipleNS(systemNamespace string, name
 	checkError(h.T(), err, "cannot uninstall rook-operator")
 
 	h.k8shelper.Clientset.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Delete("rook-ceph-webhook", nil)
-	h.k8shelper.Clientset.RbacV1().RoleBindings(systemNamespace).Delete("rook-ceph-system", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-ceph-global", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-ceph-mgr-cluster", nil)
+	h.k8shelper.Clientset.RbacV1beta1().RoleBindings(systemNamespace).Delete("rook-ceph-system", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-ceph-global", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-ceph-mgr-cluster", nil)
 	h.k8shelper.Clientset.CoreV1().ServiceAccounts(systemNamespace).Delete("rook-ceph-system", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rook-ceph-cluster-mgmt", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rook-ceph-mgr-cluster", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rook-ceph-mgr-system", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rook-ceph-global", nil)
-	h.k8shelper.Clientset.RbacV1().Roles(systemNamespace).Delete("rook-ceph-system", nil)
-
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rbd-csi-nodeplugin", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rbd-csi-nodeplugin", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rbd-csi-provisioner-role", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rbd-external-provisioner-runner", nil)
-
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("cephfs-csi-nodeplugin", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("cephfs-csi-nodeplugin", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("cephfs-csi-provisioner-role", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("cephfs-external-provisioner-runner", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rook-ceph-cluster-mgmt", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rook-ceph-mgr-cluster", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rook-ceph-mgr-system", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rook-ceph-global", nil)
+	h.k8shelper.Clientset.RbacV1beta1().Roles(systemNamespace).Delete("rook-ceph-system", nil)
+
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rbd-csi-nodeplugin", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rbd-csi-nodeplugin", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rbd-csi-provisioner-role", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rbd-external-provisioner-runner", nil)
+
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("cephfs-csi-nodeplugin", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("cephfs-csi-nodeplugin", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("cephfs-csi-provisioner-role", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("cephfs-external-provisioner-runner", nil)
 
 	h.k8shelper.Clientset.PolicyV1beta1().PodSecurityPolicies().Delete("rook-privileged", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("psp:rook", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-ceph-system-psp", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-csi-rbd-provisioner-sa-psp", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-csi-rbd-plugin-sa-psp", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-csi-cephfs-provisioner-sa-psp", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-csi-cephfs-plugin-sa-psp", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("psp:rook", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-ceph-system-psp", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-csi-rbd-provisioner-sa-psp", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-csi-rbd-plugin-sa-psp", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-csi-cephfs-provisioner-sa-psp", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-csi-cephfs-plugin-sa-psp", nil)
 
 	h.k8shelper.Clientset.CoreV1().ConfigMaps(systemNamespace).Delete("csi-rbd-config", nil)
 	h.k8shelper.Clientset.CoreV1().ConfigMaps(systemNamespace).Delete("csi-cephfs-config", nil)
 
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("rook-ceph-object-bucket", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("rook-ceph-object-bucket", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("rook-ceph-object-bucket", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("rook-ceph-object-bucket", nil)
 
 	logger.Infof("done removing the operator from namespace %s", systemNamespace)
 	logger.Infof("removing host data dir %s", h.hostPathToDelete)
diff --git a/tests/framework/installer/ceph_manifests.go b/tests/framework/installer/ceph_manifests.go
index 70d179aee..8b5f3169b 100644
--- a/tests/framework/installer/ceph_manifests.go
+++ b/tests/framework/installer/ceph_manifests.go
@@ -791,7 +791,7 @@ spec:
 // GetRookOperator returns rook Operator manifest
 func (m *CephManifestsMaster) GetRookOperator(namespace string) string {
 	return `
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-ceph-system
@@ -826,7 +826,7 @@ rules:
   verbs:
   - get
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-cluster-mgmt
@@ -864,7 +864,7 @@ rules:
   - update
   - delete
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global
@@ -975,7 +975,7 @@ rules:
   - delete
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
 rules:
@@ -1001,7 +1001,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
 rules:
@@ -1014,7 +1014,7 @@ rules:
   - list
 ---
 # Aspects of Rook Ceph Agent that require access to secrets
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-agent-mount
@@ -1031,7 +1031,7 @@ rules:
 ---
 # Aspects of ceph-mgr that require access to the system namespace
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
 rules:
@@ -1045,7 +1045,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
   labels:
@@ -1075,7 +1075,7 @@ rules:
   - "*"
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
 roleRef:
@@ -1097,7 +1097,7 @@ metadata:
     storage-backend: ceph
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-system
   namespace: ` + namespace + `
@@ -1114,7 +1114,7 @@ subjects:
   namespace: ` + namespace + `
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-global
   labels:
@@ -1634,7 +1634,7 @@ metadata:
   namespace: ` + namespace + `
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: ` + namespace + `
@@ -1648,7 +1648,7 @@ rules:
 ---
 # Aspects of ceph-mgr that operate within the cluster's namespace
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace: ` + namespace + `
@@ -1684,7 +1684,7 @@ rules:
 ---
 # Allow the ceph osd to access cluster-wide resources necessary for determining their topology location
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd-` + namespace + `
 roleRef:
@@ -1698,7 +1698,7 @@ subjects:
 ---
 # Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster-` + namespace + `
 roleRef:
@@ -1711,7 +1711,7 @@ subjects:
   namespace: ` + namespace + `
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: ` + namespace + `
@@ -1731,7 +1731,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cluster-mgmt
   namespace: ` + namespace + `
@@ -1746,7 +1746,7 @@ subjects:
 ---
 # Allow the osd pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-osd
   namespace: ` + namespace + `
@@ -1761,7 +1761,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the cluster-specific resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr
   namespace: ` + namespace + `
@@ -1776,7 +1776,7 @@ subjects:
 ---
 # Allow the ceph mgr to access the rook system resources necessary for the mgr modules
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system ` + namespace + `
   namespace: ` + systemNamespace + `
@@ -1790,7 +1790,7 @@ subjects:
   namespace: ` + namespace + `
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: ` + namespace + `
@@ -2232,7 +2232,7 @@ spec:
 func (m *CephManifestsMaster) GetClusterExternalRoles(namespace, firstClusterNamespace string) string {
 	return `apiVersion: v1
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cluster-mgmt
   namespace: ` + namespace + `
@@ -2246,7 +2246,7 @@ subjects:
   namespace: ` + firstClusterNamespace + `
 ---
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: ` + namespace + `
@@ -2266,7 +2266,7 @@ metadata:
   namespace: ` + namespace + `
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-cmd-reporter
   namespace: ` + namespace + `
diff --git a/tests/framework/installer/cockroachdb_installer.go b/tests/framework/installer/cockroachdb_installer.go
index 674dbf606..bf9b8166c 100644
--- a/tests/framework/installer/cockroachdb_installer.go
+++ b/tests/framework/installer/cockroachdb_installer.go
@@ -145,7 +145,7 @@ func (h *CockroachDBInstaller) UninstallCockroachDB(systemNamespace, namespace s
 	err = UninstallHostPathProvisioner(h.k8shelper)
 	checkError(h.T(), err, "cannot uninstall hostpath provisioner")
 
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("anon-user-access", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("anon-user-access", nil)
 	logger.Infof("done removing the operator from namespace %s", systemNamespace)
 }
 
diff --git a/tests/framework/installer/cockroachdb_manifests.go b/tests/framework/installer/cockroachdb_manifests.go
index c5d74edab..b4bf12b43 100644
--- a/tests/framework/installer/cockroachdb_manifests.go
+++ b/tests/framework/installer/cockroachdb_manifests.go
@@ -49,7 +49,7 @@ apiVersion: v1
 metadata:
   name: ` + namespace + `
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-cockroachdb-operator
@@ -93,7 +93,7 @@ metadata:
   namespace: ` + namespace + `
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-cockroachdb-operator
 roleRef:
diff --git a/tests/framework/installer/edgefs_manifest.go b/tests/framework/installer/edgefs_manifest.go
index 628a0c173..c87ca48bc 100644
--- a/tests/framework/installer/edgefs_manifest.go
+++ b/tests/framework/installer/edgefs_manifest.go
@@ -42,7 +42,7 @@ metadata:
   name: ` + namespace + `
 ---
 # The cluster role for managing all the cluster-specific resources in a namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-edgefs-cluster-mgmt
@@ -61,7 +61,7 @@ rules:
   verbs: ["get", "list", "watch", "create", "update", "delete"]
 ---
 # The role for the operator to manage resources in the system namespace
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: rook-edgefs-system
@@ -78,7 +78,7 @@ rules:
   verbs: ["get", "list", "watch", "create", "update", "delete"]
 ---
 # The cluster role for managing the Rook CRDs
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-edgefs-global
@@ -120,7 +120,7 @@ metadata:
 ---
 # Grant the operator, agent, and discovery agents access to resources in the rook-ceph-system namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-system
   namespace: ` + namespace + `
@@ -138,7 +138,7 @@ subjects:
 ---
 # Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-global
   labels:
@@ -200,7 +200,7 @@ metadata:
   namespace: ` + namespace + `
 ---
 kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: ` + namespace + `
@@ -217,7 +217,7 @@ rules:
 ---
 # Allow the operator to create resources in this cluster's namespace
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster-mgmt
   namespace: ` + namespace + `
@@ -232,7 +232,7 @@ subjects:
 ---
 # Allow the pods in this namespace to work with configmaps
 kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-edgefs-cluster
   namespace: ` + namespace + `
diff --git a/tests/framework/installer/nfs_installer.go b/tests/framework/installer/nfs_installer.go
index 572deb6d6..8a954f6d1 100644
--- a/tests/framework/installer/nfs_installer.go
+++ b/tests/framework/installer/nfs_installer.go
@@ -182,9 +182,9 @@ func (h *NFSInstaller) UninstallNFSServer(systemNamespace, namespace string) {
 	err = UninstallHostPathProvisioner(h.k8shelper)
 	checkError(h.T(), err, "cannot uninstall hostpath provisioner")
 
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("anon-user-access", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoleBindings().Delete("run-nfs-client-provisioner", nil)
-	h.k8shelper.Clientset.RbacV1().ClusterRoles().Delete("nfs-client-provisioner-runner", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("anon-user-access", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("run-nfs-client-provisioner", nil)
+	h.k8shelper.Clientset.RbacV1beta1().ClusterRoles().Delete("nfs-client-provisioner-runner", nil)
 	logger.Infof("done removing the operator from namespace %s", systemNamespace)
 }
 
diff --git a/tests/framework/installer/nfs_manifests.go b/tests/framework/installer/nfs_manifests.go
index 16a8138f9..bfda108ab 100644
--- a/tests/framework/installer/nfs_manifests.go
+++ b/tests/framework/installer/nfs_manifests.go
@@ -190,7 +190,7 @@ kind: Namespace
 metadata:
   name:  ` + namespace + `
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-nfs-operator
@@ -276,7 +276,7 @@ metadata:
   namespace: ` + namespace + `
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-nfs-operator
 roleRef:
diff --git a/tests/framework/installer/yugabytedb_installer.go b/tests/framework/installer/yugabytedb_installer.go
index 8793f5f4c..fe64524a5 100644
--- a/tests/framework/installer/yugabytedb_installer.go
+++ b/tests/framework/installer/yugabytedb_installer.go
@@ -154,7 +154,7 @@ func (y *YugabyteDBInstaller) RemoveAllYugabyteDBResources(systemNS, namespace s
 		checkError(y.T(), err, "cannot uninstall hostpath provisioner")
 	}
 
-	y.k8sHelper.Clientset.RbacV1().ClusterRoleBindings().Delete("anon-user-access", nil)
+	y.k8sHelper.Clientset.RbacV1beta1().ClusterRoleBindings().Delete("anon-user-access", nil)
 	logger.Infof("done removing the operator from namespace %s", systemNS)
 
 	return nil
diff --git a/tests/framework/installer/yugabytedb_manifests.go b/tests/framework/installer/yugabytedb_manifests.go
index f84bff646..238d12e7e 100644
--- a/tests/framework/installer/yugabytedb_manifests.go
+++ b/tests/framework/installer/yugabytedb_manifests.go
@@ -27,7 +27,7 @@ kind: Namespace
 metadata:
   name: ` + namespace + `
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-yugabytedb-operator
@@ -76,7 +76,7 @@ metadata:
   name: rook-yugabytedb-operator
   namespace: ` + namespace + `
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: rook-yugabytedb-operator
diff --git a/tests/framework/utils/k8s_helper.go b/tests/framework/utils/k8s_helper.go
index f9d02e19e..3aa957e8e 100644
--- a/tests/framework/utils/k8s_helper.go
+++ b/tests/framework/utils/k8s_helper.go
@@ -1578,7 +1578,7 @@ func (k8sh *K8sHelper) CreateAnonSystemClusterBinding() {
 
 	for i := 0; i < RetryLoop; i++ {
 		var err error
-		if _, err = k8sh.Clientset.RbacV1().ClusterRoleBindings().Get("anon-user-access", metav1.GetOptions{}); err == nil {
+		if _, err = k8sh.Clientset.RbacV1beta1().ClusterRoleBindings().Get("anon-user-access", metav1.GetOptions{}); err == nil {
 			break
 		}
 		logger.Warningf("failed to get anon-user-access clusterrolebinding, will try again: %+v", err)
diff --git a/tests/integration/ceph_base_file_test.go b/tests/integration/ceph_base_file_test.go
index c2e73be6e..f02d67659 100644
--- a/tests/integration/ceph_base_file_test.go
+++ b/tests/integration/ceph_base_file_test.go
@@ -321,7 +321,7 @@ func createFilesystemMountUserConsumerPod(helper *clients.TestClient, k8sh *util
 }
 
 func getFilesystemAgentMountSecretsBinding(namespace string) string {
-	return `apiVersion: rbac.authorization.k8s.io/v1
+	return `apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: rook-ceph-agent-mount
diff --git a/tests/integration/ceph_smoke_test.go b/tests/integration/ceph_smoke_test.go
index 22d548c33..85ddfbfbf 100644
--- a/tests/integration/ceph_smoke_test.go
+++ b/tests/integration/ceph_smoke_test.go
@@ -88,7 +88,7 @@ func (suite *SmokeSuite) SetupSuite() {
 		usePVC:                  false,
 		mons:                    3,
 		rbdMirrorWorkers:        1,
-		rookCephCleanup:         true,
+		rookCephCleanup:         false,
 		skipOSDCreation:         false,
 		minimalMatrixK8sVersion: smokeSuiteMinimalTestVersion,
 		rookVersion:             installer.VersionMaster,
@@ -302,9 +302,6 @@ func (suite *SmokeSuite) TestCreateRBDMirrorClient() {
 
 	err := suite.helper.RBDMirrorClient.Create(suite.namespace, rbdMirrorName, 1)
 	require.Nil(suite.T(), err)
-
-	err = suite.helper.RBDMirrorClient.Delete(suite.namespace, rbdMirrorName)
-	require.Nil(suite.T(), err)
 }
 
 func (suite *SmokeSuite) getNonCanaryMonDeployments() ([]appsv1.Deployment, error) {
diff --git a/tests/integration/ceph_upgrade_test.go b/tests/integration/ceph_upgrade_test.go
index f11d0f649..8cb3c8092 100644
--- a/tests/integration/ceph_upgrade_test.go
+++ b/tests/integration/ceph_upgrade_test.go
@@ -430,7 +430,7 @@ spec:
   scope: Namespaced
   version: v1
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global
@@ -540,7 +540,7 @@ rules:
   - create
   - delete
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-cluster-mgmt
@@ -570,7 +570,7 @@ rules:
   - delete
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-cluster
   labels:
@@ -599,7 +599,7 @@ rules:
   - watch
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-object-bucket
   labels:
@@ -629,7 +629,7 @@ rules:
   - "*"
 ---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: rook-ceph-mgr-system
 rules:
@@ -844,7 +844,7 @@ rules:
      resources: ["persistentvolumeclaims/status"]
      verbs: ["update", "patch"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: rook-ceph-global-rules