From db4b3322faf3ab0708d8bfee03d5e9f2f2008aed Mon Sep 17 00:00:00 2001 From: Redouane Kachach Date: Fri, 9 Feb 2024 16:55:04 +0100 Subject: [PATCH] mgr: remove privileged security context from mgr sidecar container Mgr sidecar was using a privileged security context because it needed to create the /var/lib/rook directory, generate the config on it, and then copy it to the /etc/ceph directory. This change creates empty directories on /var/lib/rook and /etc/ceph so the mgr sidecar can use them, removing the need for using a privileged security context. Fixes: https://github.com/rook/rook/issues/13719 Signed-off-by: Redouane Kachach --- pkg/operator/ceph/cluster/mgr/spec.go | 30 ++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/pkg/operator/ceph/cluster/mgr/spec.go b/pkg/operator/ceph/cluster/mgr/spec.go index d2167c81e..4a452a70a 100644 --- a/pkg/operator/ceph/cluster/mgr/spec.go +++ b/pkg/operator/ceph/cluster/mgr/spec.go @@ -74,7 +74,19 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error) if c.spec.Mgr.Count > 1 { podSpec.Spec.Containers = append(podSpec.Spec.Containers, c.makeMgrSidecarContainer(mgrConfig)) matchLabels := controller.AppLabels(AppName, c.clusterInfo.Namespace) - podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, mon.CephSecretVolume()) + // append ceph secret volume and some empty volumes needed by the mgr sidecar + podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, + v1.Volume{ + Name: "rook-config", + VolumeSource: v1.VolumeSource{ + EmptyDir: &v1.EmptyDirVolumeSource{}, + }}, + v1.Volume{ + Name: "default-config-dir", + VolumeSource: v1.VolumeSource{ + EmptyDir: &v1.EmptyDirVolumeSource{}, + }}, + mon.CephSecretVolume()) // Stretch the mgrs across hosts by default, or across a bigger failure domain for when zones are required like in case of stretched cluster topologyKey := v1.LabelHostname @@ -225,6 +237,18 @@ func (c *Cluster) makeMgrSidecarContainer(mgrConfig *mgrConfig) v1.Container { {Name: "ROOK_CEPH_VERSION", Value: "ceph version " + c.clusterInfo.CephVersion.String()}, } + volumeMounts := []v1.VolumeMount{ + { + MountPath: "/var/lib/rook", + Name: "rook-config", + }, + { + MountPath: "/etc/ceph", + Name: "default-config-dir", + }, + } + volumeMounts = append(volumeMounts, mon.CephSecretVolumeMount()) + return v1.Container{ Args: []string{"ceph", "mgr", "watch-active"}, Name: "watch-active", @@ -232,8 +256,8 @@ func (c *Cluster) makeMgrSidecarContainer(mgrConfig *mgrConfig) v1.Container { ImagePullPolicy: controller.GetContainerImagePullPolicy(c.spec.CephVersion.ImagePullPolicy), Env: envVars, Resources: cephv1.GetMgrSidecarResources(c.spec.Resources), - SecurityContext: controller.PrivilegedContext(true), - VolumeMounts: []v1.VolumeMount{mon.CephSecretVolumeMount()}, + SecurityContext: controller.PodSecurityContext(), + VolumeMounts: volumeMounts, } }