mirror of
https://github.com/SynologyOpenSource/synology-csi.git
synced 2026-08-19 11:36:33 +00:00
benzheng
4c5e192954
The DSM WebAPI client disabled TLS certificate verification for all
HTTPS connections (InsecureSkipVerify: true), then sent the configured
DSM account and password to the endpoint. An attacker able to intercept,
redirect, or impersonate the DSM HTTPS endpoint could therefore obtain
the DSM credentials stored in the CSI client config / Kubernetes secret
(CWE-295 Improper Certificate Validation, OWASP A3:2017 Sensitive Data Exposure)
TLS certificate verification is now enabled by default. The client trusts
the system CA pool, so certificates signed by a public CA work without
extra configuration. Three optional client-info fields are added:
- tlsCACert: PEM CA cert to trust (for DSM self-signed certs);
merged with the system CA pool.
- tlsServerName: override the name checked during verification,
e.g. when connecting by IP.
- insecureSkipVerify: explicit opt-out that restores the old behavior;
logs a warning on every connection.
The new fields are propagated through all DSM construction sites
(service, synocli, and the HA GetAnotherController path).
BREAKING CHANGE: deployments using `https: true` against a DSM with a
self-signed certificate (the DSM default) will fail to connect after
upgrade until they set `tlsCACert`, `tlsServerName`, or (discouraged)
`insecureSkipVerify: true`.
Adds TLS tests covering default-reject, valid-CA accept, wrong-CA reject,
insecureSkipVerify opt-in, and the tlsServerName DNS-SAN scenarios.
109 lines
3.8 KiB
YAML
109 lines
3.8 KiB
YAML
---
|
|
clientInfoSecret:
|
|
# How to connect to your Synology Diskstation?
|
|
clients:
|
|
- host: 192.168.1.1 # the IP address of the Diskstation
|
|
https: false # whether the port expects HTTPS or not
|
|
password: password # the password of the dedicated CSI user
|
|
port: 5000 # the port for connecting to the Diskstation Manager application
|
|
username: username # the name of the dedicated CSI user
|
|
- host: 192.168.1.1
|
|
https: true
|
|
password: password
|
|
port: 5001
|
|
username: username
|
|
# (optional) tlsCACert: PEM-encoded CA certificate to verify the DSM HTTPS endpoint.
|
|
# Required when DSM uses a self-signed certificate.
|
|
# tlsCACert: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# ...
|
|
# -----END CERTIFICATE-----
|
|
# tlsServerName: "" # (optional) Override TLS server name, e.g. when connecting by IP.
|
|
# insecureSkipVerify: false # (optional) Disable TLS verification. Not recommended; use tlsCACert instead.
|
|
# Whether to create the secret if the chart gets installed or not; ignored on updates.
|
|
create: false
|
|
# Defaults to {{ include "synology-csi.fullname" $ }}-client-info if empty or not present:
|
|
name: "client-info-secret"
|
|
# Specifies affinity, nodeSelector and tolerations for the controller StatefulSet
|
|
controller:
|
|
affinity: { }
|
|
nodeSelector: { }
|
|
tolerations: [ ]
|
|
fullnameOverride: ""
|
|
images:
|
|
attacher:
|
|
image: registry.k8s.io/sig-storage/csi-attacher
|
|
pullPolicy: IfNotPresent
|
|
tag: v4.2.0
|
|
nodeDriverRegistrar:
|
|
image: registry.k8s.io/sig-storage/csi-node-driver-registrar
|
|
pullPolicy: IfNotPresent
|
|
tag: v2.6.3
|
|
plugin:
|
|
image: synology/synology-csi
|
|
pullPolicy: IfNotPresent
|
|
# Defaults to {{ $.Chart.AppVersion }} if empty or not present:
|
|
tag: ""
|
|
supportChrootDir: true
|
|
provisioner:
|
|
image: registry.k8s.io/sig-storage/csi-provisioner
|
|
pullPolicy: IfNotPresent
|
|
tag: v3.4.0
|
|
resizer:
|
|
image: registry.k8s.io/sig-storage/csi-resizer
|
|
pullPolicy: IfNotPresent
|
|
tag: v1.7.0
|
|
snapshotter:
|
|
image: registry.k8s.io/sig-storage/csi-snapshotter
|
|
pullPolicy: IfNotPresent
|
|
tag: v4.2.1
|
|
installCSIDriver: true
|
|
nameOverride: ""
|
|
# Specifies affinity, nodeSelector and tolerations for the node DaemonSet
|
|
node:
|
|
affinity: { }
|
|
nodeSelector: { }
|
|
tolerations: [ ]
|
|
# If your kubelet path is not standard, specify it here :
|
|
## example for miocrok8s distrib : /var/snap/microk8s/common/var/lib/kubelet
|
|
kubeletPath: /var/lib/kubelet
|
|
extraArgs: []
|
|
# - --iscsiadm-path=/usr/local/sbin/iscsiadm
|
|
# Specifies affinity, nodeSelector and tolerations for the snapshotter StatefulSet
|
|
snapshotter:
|
|
affinity: { }
|
|
nodeSelector: { }
|
|
tolerations: [ ]
|
|
storageClasses:
|
|
synology-iscsi-storage:
|
|
# One of true or false (default):
|
|
##disabled: false
|
|
# One of true or false (default):
|
|
##isDefault: false
|
|
# One of "Retain" or "Delete" (default):
|
|
reclaimPolicy: Retain
|
|
# One of "WaitForFirstConsumer" or "Immediate" (default):
|
|
##volumeBindingMode: Immediate
|
|
|
|
# If not present, some location will be chosen to create volumes with the filesystem type ext4.
|
|
# Note that these parameters cannot get updated once deployed - any subsequent changes get ignored!
|
|
##parameters:
|
|
## dsm: "1.1.1.1"
|
|
## fsType: ext4
|
|
## location: /volume1
|
|
# synology-iscsi-storage-delete:
|
|
# reclaimPolicy: Delete
|
|
volumeSnapshotClasses:
|
|
synology-snapshotclass:
|
|
# One of true or false (default):
|
|
##disabled: false
|
|
# One of "Retain" or "Delete" (default):
|
|
deletionPolicy: Delete
|
|
# One of true or false (default):
|
|
##isDefault: false
|
|
|
|
# Note that these parameters cannot get updated once deployed - any subsequent changes get ignored!
|
|
##parameters:
|
|
## description: "Kubernetes CSI"
|
|
## is_locked: "false"
|