Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

deploy: setting RequiredDropCapabilities to ALL for ceph-csi scc #4767

Merged
merged 1 commit into from
Aug 15, 2024
Merged

deploy: setting RequiredDropCapabilities to ALL for ceph-csi scc #4767

merged 1 commit into from
Aug 15, 2024

Conversation

ShravaniVangur
Copy link
Contributor

@ShravaniVangur ShravaniVangur commented Aug 14, 2024 •
edited
Loading

This commit sets the RequiredDropCapabilities of ceph-csi to "ALL".

Describe what this PR does

In line with the principle of least privilege, permissions should be granted with only the minimal access necessary to perform the required tasks. Previously, the security context constraints for ceph-csi did not have RequiredDropCapabilities set. This commit ensures that it is now set to "ALL".
$oc describe scc rook-ceph-csi | grep " Required Drop Capabilities"
Required Drop Capabilities: ALL

Rakshith-R
Rakshith-R reviewed Aug 14, 2024
View reviewed changes
Copy link
Contributor

@Rakshith-R Rakshith-R left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's ceph-csi scc

ceph-csi/deploy/scc.yaml

Line 12 in 3f5bbb9

name: "ceph-csi"

deploy: is suited better for commit header

https://github.com/ceph/ceph-csi/blob/fb9403e82065c3a90459bc9f7d7d28e476770374/docs/development-guide.md#commit-messages

Can you please confirm you have tested the changes in openshift environment and everything works as expected ?

@nixpanic nixpanic added the component/deployment Helm chart, kubernetes templates and configuration Issues/PRs label Aug 14, 2024
@ShravaniVangur ShravaniVangur changed the title util: setting RequiredDropCapabilities to ALL for rook-ceph-csi scc deploy: setting RequiredDropCapabilities to ALL for ceph-csi scc Aug 14, 2024
@ShravaniVangur
Copy link
Contributor Author

ShravaniVangur commented Aug 14, 2024 •
edited
Loading

@Rakshith-R The following have been tested with the changes in this PR in the openshift environment:

  • Successful deployment of storagecluster.
  • Creation of PVCs for cephfs and rbd following which pods were created with the respective pvcs.
  • Edited the PVC size.
  • Taking a snapshot.
  • Cloned the PVC.
    At each point the provisioner/plugin logs were checked to ensure success of the action.

@Madhu-1 Madhu-1 requested review from Rakshith-R and a team August 15, 2024 09:52
@Madhu-1 Madhu-1 added ci/skip/e2e skip running e2e CI jobs ci/skip/multi-arch-build skip building on multiple architectures labels Aug 15, 2024
@Madhu-1
Copy link
Collaborator

Madhu-1 commented Aug 15, 2024

skipping e2e and multi-arch as its not required for this PR.

@nixpanic
Copy link
Member

@Mergifyio rebase

@ShravaniVangur @nixpanic
deploy: setting RequiredDropCapabilities to ALL for ceph-csi scc
0b15454 
This commit sets the RequiredDropCapabilities of ceph-csi to "ALL".

Signed-off-by: ShravaniVangur <shravanivangur@gmail.com>
@mergify Mergify
Copy link
Contributor

mergify bot commented Aug 15, 2024

rebase

✅ Branch has been successfully rebased

@nixpanic
Copy link
Member

@Mergifyio queue

@mergify Mergify
Copy link
Contributor

mergify bot commented Aug 15, 2024 •
edited
Loading

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 0eabe32

@mergify mergify bot added the ok-to-test Label to trigger E2E tests label Aug 15, 2024
@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.29

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.29

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e/k8s-1.29

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/upgrade-tests-cephfs

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.31

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/upgrade-tests-rbd

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.31

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e/k8s-1.31

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.30

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.30

@ceph-csi-bot
Copy link
Collaborator

/test ci/centos/mini-e2e/k8s-1.30

@ceph-csi-bot ceph-csi-bot removed the ok-to-test Label to trigger E2E tests label Aug 15, 2024
@mergify mergify bot merged commit 0eabe32 into ceph:devel Aug 15, 2024
37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Madhu-1 Madhu-1 Madhu-1 approved these changes

@nixpanic nixpanic nixpanic approved these changes

@Rakshith-R Rakshith-R Awaiting requested review from Rakshith-R

Assignees
No one assigned
Labels
ci/skip/e2e skip running e2e CI jobs ci/skip/multi-arch-build skip building on multiple architectures component/deployment Helm chart, kubernetes templates and configuration Issues/PRs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ShravaniVangur @Madhu-1 @nixpanic @ceph-csi-bot @Rakshith-R