mgr/cephadm: Disable external snapshots in grafana

This PR intends to disable the external snapshots in grafana to reduce security threats

Signed-off-by: Aashish Sharma <aasharma@redhat.com>

diff --git a/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2 b/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
index cf23802d71b78d014773c4112843612aebe33f0d..e7e81d89a4b6f682a471e442a04dfee69e83d8ee 100644 (file)
--- a/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
+++ b/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
@@ -12,6 +12,8 @@
   cert_key = /etc/grafana/certs/cert_key
   http_port = {{ http_port }}
   http_addr = {{ http_addr }}
+[snapshots]
+  external_enabled = false
 [security]
 {% if not initial_admin_password %}
   disable_initial_admin_creation = true

diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index e401c5b93d024ee8ee0d726435246bf6676b86e9..e59e95c7bad29541133ed8acb8fb62dc2a1542e9 100644 (file)
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -453,6 +453,8 @@ class TestMonitoring:
                           cert_key = /etc/grafana/certs/cert_key
                           http_port = 3000
                           http_addr = 
+                        [snapshots]
+                          external_enabled = false
                         [security]
                           disable_initial_admin_creation = true
                           cookie_secure = true
@@ -531,6 +533,8 @@ class TestMonitoring:
                                     '  cert_key = /etc/grafana/certs/cert_key\n'
                                     '  http_port = 3000\n'
                                     '  http_addr = \n'
+                                    '[snapshots]\n'
+                                    '  external_enabled = false\n'
                                     '[security]\n'
                                     '  admin_user = admin\n'
                                     '  admin_password = secure\n'