zerotens comments

Results 7 comments of


                                            zerotens

Support storing cephfs omap in a different namespace in rados under same filesystem metadata pool

Hello together, funny story. I wrote today a PR, but i didn't see the issue and that @iPraveenParihar was already working on it. https://github.com/ceph/ceph-csi/compare/devel...zerotens:cephfs-namespace?expand=1 Is this reasonable to you or...

Support storing cephfs omap in a different namespace in rados under same filesystem metadata pool

> > @zerotens, Thanks for the PR 😃 I had already started working on this issue and was testing the same, and have opened a PR now #4661 > >...

A potential risk in piraeus which can be leveraged to make a cluster-level priviege escalation

The harder part is to mitigate most attack scenarios. To check for problematic rbac permissions: https://github.com/PaloAltoNetworks/rbac-police ``` ./rbac-police_v1.1.2_linux_amd64 eval lib/ -n piraeus-datastor ... "summary": { "failed": 8, "passed": 15, "errors":...

Support storing cephfs omap in a different namespace in rados under same filesystem metadata pool

@nixpanic Linting was hopefully fixed /retest please

Support storing cephfs omap in a different namespace in rados under same filesystem metadata pool

@Rakshith-R @iPraveenParihar Is this going to be available in the next release? Any concerns?

CephFS keyring requires nonsensicaly enormous and insecure privileges to work

@benapetr > So does that mean that only safe and truly isolated way to allow multiple k8s clusters to use CephFS is to build dedicated CEPH cluster for each k8s...

CephFS keyring requires nonsensicaly enormous and insecure privileges to work

So i had some time. About other caps OSD/MDS and the last pieces: `export CLUSTER="my-k8s-cluster-1"` `# create subvolumegroup for cluster` `ceph fs subvolumegroup create k8s-fs $CLUSTER` `# set specific radosNamespace...