run ceph-csi as non-root and configurable UID/GID
- Dominant language
- Go
- Stars
- 1.6k
- Forks
- 617
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 43
Description
# Describe the feature you'd like to have #
Run ceph-csi as non-root and with configurable UID/GID.
# What is the value to the end user? (why is it a priority?) #
In an enterprise environment, running containers as root is a security concern.
For example, Ceph daemons support running as non-root with configurable UID/GID
https://docs.ceph.com/en/pacific/man/8/ceph/?highlight=setuser#cmdoption-ceph-setuser
```
--setuser user
will apply the appropriate user ownership to the file specified by the option ‘-o’.
--setgroup group
will apply the appropriate group ownership to the file specified by the option ‘-o’.
```
If ceph csi would support running as non-root with configurable UID/GID, the solution would be complete.
# How will we know we have a good solution? (acceptance criteria) #
Check OS process owner. Example for ceph-mgr
```
$ ps aux
167 244582 1.3 2.3 1547924 387256 ? Ssl Sep15 23:30 ceph-mgr --fsid=4b8c33bf-eaa1-45fa-a350-c40b17c04e2a --keyring=/etc/ceph/keyring-store/keyring --log-to-stderr=true --err-to-stderr=true --mon-cluster-log-to-stderr=true --log-stderr-prefix=debug --default-log-to-file=false --default-mon-cluster-log-to-file=false --mon-host=[v2:10.10.10.7:3300,v1:10.10.10.7:6789],[v2:10.10.10.172:3300,v1:10.10.10.172:6789],[v2:10.10.10.112:3300,v1:10.10.10.112:6789] --mon-initial-members=a,b,c --id=a --setuser=ceph --setgroup=ceph --client-mount-uid=0 --client-mount-gid=0 --foreground
```
# Additional context #
This feature was mentioned in https://github.com/ceph/ceph-csi/issues/714, but the ticket was closed due to inactivity.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names no repository files or tests; start by locating the ceph-csi container manifests and the process entry points that launch its components. Define how UID/GID configuration is passed through deployment and startup, then verify the resulting OS process owner and add coverage for the supported configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100