ceph / ceph/ceph-csi

run ceph-csi as non-root and configurable UID/GID

Open
#2,519 7 comments 3 reactions 0 assignees View on GitHub
component/deployment enhancement needs-research security VolunteersRequired
Dominant language
Go
Stars
1.6k
Forks
617
Avg merge
5d 10h
Merged PRs (30d)
43

Description

# Describe the feature you'd like to have #

Run ceph-csi as non-root and with configurable UID/GID.

# What is the value to the end user? (why is it a priority?) #

In an enterprise environment, running containers as root is a security concern.
For example, Ceph daemons support running as non-root with configurable UID/GID
https://docs.ceph.com/en/pacific/man/8/ceph/?highlight=setuser#cmdoption-ceph-setuser
```
--setuser user
will apply the appropriate user ownership to the file specified by the option ‘-o’.

--setgroup group
will apply the appropriate group ownership to the file specified by the option ‘-o’.
```
If ceph csi would support running as non-root with configurable UID/GID, the solution would be complete.

# How will we know we have a good solution? (acceptance criteria) #

Check OS process owner. Example for ceph-mgr
```
$ ps aux
167 244582 1.3 2.3 1547924 387256 ? Ssl Sep15 23:30 ceph-mgr --fsid=4b8c33bf-eaa1-45fa-a350-c40b17c04e2a --keyring=/etc/ceph/keyring-store/keyring --log-to-stderr=true --err-to-stderr=true --mon-cluster-log-to-stderr=true --log-stderr-prefix=debug --default-log-to-file=false --default-mon-cluster-log-to-file=false --mon-host=[v2:10.10.10.7:3300,v1:10.10.10.7:6789],[v2:10.10.10.172:3300,v1:10.10.10.172:6789],[v2:10.10.10.112:3300,v1:10.10.10.112:6789] --mon-initial-members=a,b,c --id=a --setuser=ceph --setgroup=ceph --client-mount-uid=0 --client-mount-gid=0 --foreground

```
# Additional context #
This feature was mentioned in https://github.com/ceph/ceph-csi/issues/714, but the ticket was closed due to inactivity.

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no repository files or tests; start by locating the ceph-csi container manifests and the process entry points that launch its components. Define how UID/GID configuration is passed through deployment and startup, then verify the resulting OS process owner and add coverage for the supported configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.