Rules

[rsacherer]

Rules

• Use a rule parser and some kind of formatted rules?
  • Parser needs to be written, rather unflexible as you need to stay within the parsers guidelines.
• Use python modules which are loaded at runtime
  • Very flexible
  • how to deliver if we want to be better updateable than standard releases?
    • modules could be feched via git, https://www.dulwich.io/ is a pure python git implementation which could fetch modules. CU could define different rule repositories (redhat, proprietary, etc.). We can check and update rules on MGR start and via a dedicated update command. One drawback is you need internet connection. We could do some cephadm magic to help with static deployments. Store them in /var/lib/ceph//mgr./data/plugins for example.
• ?

I think we need to create a base set of rules to see if they could be used with a rather simple parser, would osd_map, pg's health warn's, etc be sufficient?

I think we need a list of rules first to determine the best way to implement them, I'd love plugins, as they are most flexible.

We need to think about security if we can feed rules into the MGR.

• Exploits
• DOS (bringing MGR down)
• Data exfiltration (plugins could syphon data, what data can a MGR plugin collect actually?)

[rsacherer]

Re-import modules:

>>> import importlib
>>> importlib.reload(foo)

After a module upgrade. CHAD does not need to be available at minute one, so needing some time to fetch/upgrade the modules on MGR start (normal start, failover) does not matter.

Disconnected environments can just download the modules they want and use cephadm config-files or additional file feature to add them manually to /var/lib/ceph[...] directory.