Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.
5.2.8 Minimize the admission of containers with added capabilities
Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
Finish the process of deprecating holder pods by removing Rook's ability
to deploy them. The intent of this change is to make the most
superficial changes possible to accomplish this. There are still
remnants of code in Rook (particularly the CSI controller) that helped
configure or deploy holder pods. Due to the risk of breaking some
features, cleanup work of hose remnants will be deferred for future
work.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Resolves CIS benchmark rule 5.7.3, Pods part. SecurityContext
should be explicitly defined in pod level of Pod spec section.
It is sufficient to specify empty securityContext to satisfy
CIS 5.7.3 rule.
5.7.3 Apply Security Context to Your Pods and Containers
When designing your containers and pods, make sure
that you configure the security context for your pods,
containers, and volumes.
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
deployments on openshift where we need csi container pods
to be run on privileged, the logrotate sidecar container was missing the
privileged permission letting, side car to not run properly
Signed-off-by: parth-gr <partharora1010@gmail.com>
This commit adds the flexibility to configure kube apiserver qps
as per the user requirement and also keeps the existing values as
the default one.
Signed-off-by: yite.gu <yitegu0@gmail.com>
Use the same logrotate flow of rbd, as merged in #14305
1) Make the csi cephfs and nfs container logs persisted in a file
2) Use the cephcluster api specs to configure the log rotate
3) Add log rotation to rotate the log file and
Add a sidecar log collector container
And some fixes on the implementation:
1) Add a operator namespace in the log file path
2) Only add volume to the container if logrotate is enabled
Closes: https://github.com/rook/rook/issues/12809, https://github.com/rook/rook/issues/14429
Signed-off-by: parth-gr <partharora1010@gmail.com>
With the recent enhancements csi containers for using
logrotate, they need to run with securityContext to privileged,
on platform like openshift.
Used the ROOK_HOSTPATH_REQUIRES_PRIVILEGED flag
wich is set with operator deployment to see
if the securityCOntext is needed or not
Closes: https://github.com/rook/rook/issues/14400
Signed-off-by: parth-gr <partharora1010@gmail.com>
This commit adds the flexibility to configure
leader election flags as per the user
requirement and also keeps the existing values
as the default one.
resolve: #13475
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
adding drop `ALL` capabilities in rook operator container
as this is not required and will remove warning in ocp cluster.
Signed-off-by: subhamkrai <srai@redhat.com>
adding a option to make AttachRequired field
as configurable and added a comment to explain
the consequences of changing the default value
resolves: #11805
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Introduce a new env variable ROOK_CSI_IMAGE_PULL_POLICY in rook operator configmap which should be used to
customize the imagePullPolicy for the csi driver and imagePullPolicy property in cephVersionSpec for ceph pods.
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
This commit adds holder pod support
for nfs to be able to work in non-host
networking scenario, without being
affected by restarts of csi-nfsplugin.
Signed-off-by: Rakshith R <rar@redhat.com>
Cephcsi v3.7 now supports nfs nodeserver.
This commit changes nfs nodeserver image to
cephcsi image and makes other necessary
modifications to template.
Signed-off-by: Rakshith R <rar@redhat.com>
This commit introduces new log level called csidecarLogLevel
for the sidecars which are not maintained by the csi-driver.
This will allow to have different configuration options
for the sidecars like snapshotter, resizer, attacher and
provisioner containers which will help to avoid the
spamming of logs to an extent.
Signed-off-by: yati1998 <ypadia@redhat.com>
csi pods uses leader election and they were using
default values but seems like default values of leader
election are not working for some specific clusters.
Signed-off-by: subhamkrai <srai@redhat.com>
setting the GRPC timeout configurable helps
in some cases where ceph cluster takes more time
to respond.
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Peter Razumovsky
Blaine Gardner
parth-gr
Travis Nielsen
yite.gu
parth-gr
Madhu Rajanna
Praveen M
subhamkrai
Avan Thakkar
Rakshith R
yati1998