From: Aashish Sharma <aasharma@redhat.com>
Date: Thu, 5 May 2022 08:22:33 +0000 (+0530)
Subject: mgr/cephadm: Disable external snapshots in grafana
X-Git-Tag: v18.0.0~934^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=334f4e141c8176df09d1820a1396d434e87781ae;p=ceph-ci.git

mgr/cephadm: Disable external snapshots in grafana

This PR intends to disable the external snapshots in grafana to reduce security threats

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---

diff --git a/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2 b/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
index cf23802d71b..e7e81d89a4b 100644
--- a/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
+++ b/src/pybind/mgr/cephadm/templates/services/grafana/grafana.ini.j2
@@ -12,6 +12,8 @@
   cert_key = /etc/grafana/certs/cert_key
   http_port = {{ http_port }}
   http_addr = {{ http_addr }}
+[snapshots]
+  external_enabled = false
 [security]
 {% if not initial_admin_password %}
   disable_initial_admin_creation = true
diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index e401c5b93d0..e59e95c7bad 100644
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -453,6 +453,8 @@ class TestMonitoring:
                           cert_key = /etc/grafana/certs/cert_key
                           http_port = 3000
                           http_addr = 
+                        [snapshots]
+                          external_enabled = false
                         [security]
                           disable_initial_admin_creation = true
                           cookie_secure = true
@@ -531,6 +533,8 @@ class TestMonitoring:
                                     '  cert_key = /etc/grafana/certs/cert_key\n'
                                     '  http_port = 3000\n'
                                     '  http_addr = \n'
+                                    '[snapshots]\n'
+                                    '  external_enabled = false\n'
                                     '[security]\n'
                                     '  admin_user = admin\n'
                                     '  admin_password = secure\n'