search

coreos / torus

Torus Distributed Storage
https://coreos.com/blog/torus-distributed-storage-by-coreos.html
Apache License 2.0
1.77k stars 172 forks source link

need access control of volumes #375

Open nak3 opened 7 years ago

nak3 commented 7 years ago

Currently, any users who accesses MDS(etcd) can list and use(mount) volumes. To avoid accident, access control should be implemented. There may be many ideas, but I personally think these two are necessary at the basic level.

  1. suspend function (or start/stop) for volumes.
  2. allow or reject restriction by client IPs or IP range.
barakmich commented 7 years ago

This requires a bit of thought. True; anyone with access to etcd can mess with it. This should evolve as etcd3 acls evolve.

A short term solution is to present a valid gRPC client cert to etcd; only valid users are signed.