ceph / ceph/ceph-csi

Remove `hostPID: true` from the nodeplugin pod spec

Open
#6,415 4 comments 0 reactions 0 assignees View on GitHub
cleanup component/deployment keepalive
Dominant language
Go
Stars
1.6k
Forks
617
Avg merge
5d 10h
Merged PRs (30d)
43

Description

I have a critical warning in my local playground cluster that reads like the following:

Sharing the host PID namespace lets the container see and signal all host processes, enabling process injection attacks.

K8s: Pod Security Standards
NSA/CISA Kubernetes Hardening Guide

DAEMONSET
rook-ceph / rook-ceph.rbd.csi.ceph.com-nodeplugin

Rook-Ceph version (Operator and Cluster): 1.19.7

For reference: I first opened it up here: https://github.com/rook/rook/issues/18032#issuecomment-5089145863

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the nodeplugin pod spec and its DaemonSet configuration, then inspect where hostPID is set. Confirm that removing it does not disrupt nodeplugin operation; done means the nodeplugin pod spec no longer enables the host PID namespace.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.