Skip to content

set securityContext for Pods and containers #363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 5, 2025
Merged

set securityContext for Pods and containers #363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions deploy/kubernetes/base/ds-csi-linode-node.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ spec:
app: csi-linode-node
role: csi-linode
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
priorityClassName: system-node-critical
serviceAccount: csi-node-sa
hostNetwork: true
Expand All @@ -34,6 +37,11 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- name: plugin-dir
mountPath: /csi
Expand All @@ -59,10 +67,15 @@ spec:
key: token
imagePullPolicy: "Always"
securityContext:
# This container must run as privileged due to the requirement for bidirectional mount propagation
# See https://github.com/kubernetes/kubernetes/issues/94400
privileged: true
capabilities:
add: ["SYS_ADMIN"]
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
add:
- SYS_ADMIN
volumeMounts:
- name: plugin-dir
mountPath: /csi
Expand Down
23 changes: 23 additions & 0 deletions deploy/kubernetes/base/ss-csi-linode-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@ spec:
app: csi-linode-controller
role: csi-linode
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
serviceAccount: csi-controller-sa
containers:
- name: csi-provisioner
Expand All @@ -32,6 +35,11 @@ spec:
env:
- name: ADDRESS
value: /var/lib/csi/sockets/pluginproxy/csi.sock
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy/
Expand All @@ -44,6 +52,11 @@ spec:
env:
- name: ADDRESS
value: /var/lib/csi/sockets/pluginproxy/csi.sock
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy/
Expand All @@ -56,6 +69,11 @@ spec:
env:
- name: ADDRESS
value: /var/lib/csi/sockets/pluginproxy/csi.sock
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy/
Expand All @@ -79,6 +97,11 @@ spec:
secretKeyRef:
name: linode
key: token
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy/
Expand Down
23 changes: 23 additions & 0 deletions helm-chart/csi-driver/templates/csi-linode-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@ spec:
app: csi-linode-controller
role: csi-linode
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- args:
- --default-fstype=ext4
Expand All @@ -40,6 +43,11 @@ spec:
containerPort: {{ .Values.csiProvisioner.metrics.port }}
protocol: TCP
{{- end}}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand All @@ -61,6 +69,11 @@ spec:
containerPort: {{ .Values.csiAttacher.metrics.port }}
protocol: TCP
{{- end}}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand All @@ -82,6 +95,11 @@ spec:
containerPort: {{ .Values.csiResizer.metrics.port }}
protocol: TCP
{{- end}}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand Down Expand Up @@ -118,6 +136,11 @@ spec:
image: {{ .Values.csiLinodePlugin.image }}:{{ .Values.csiLinodePlugin.tag | default .Chart.AppVersion }}
imagePullPolicy: {{ .Values.csiLinodePlugin.pullPolicy }}
name: csi-linode-plugin
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand Down
14 changes: 13 additions & 1 deletion helm-chart/csi-driver/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ spec:
app: csi-linode-node
role: csi-linode
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- args:
- --v=2
Expand All @@ -31,6 +34,11 @@ spec:
fieldPath: spec.nodeName
image: {{ .Values.csiNodeDriverRegistrar.image}}:{{ .Values.csiNodeDriverRegistrar.tag}}
name: csi-node-driver-registrar
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /csi
name: plugin-dir
Expand Down Expand Up @@ -63,11 +71,15 @@ spec:
imagePullPolicy: {{ .Values.csiLinodePlugin.pullPolicy }}
name: csi-linode-plugin
securityContext:
# This container must run as privileged due to the requirement for bidirectional mount propagation
# See https://github.com/kubernetes/kubernetes/issues/94400
privileged: true
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
add:
- SYS_ADMIN
privileged: true
volumeMounts:
- mountPath: /csi
name: plugin-dir
Expand Down
37 changes: 33 additions & 4 deletions internal/driver/deploy/releases/linode-blockstorage-csi-driver.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,11 @@ spec:
image: registry.k8s.io/sig-storage/csi-provisioner:v5.1.0
imagePullPolicy: IfNotPresent
name: csi-provisioner
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand All @@ -308,6 +313,11 @@ spec:
image: registry.k8s.io/sig-storage/csi-attacher:v4.7.0
imagePullPolicy: IfNotPresent
name: csi-attacher
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand All @@ -320,6 +330,11 @@ spec:
image: registry.k8s.io/sig-storage/csi-resizer:v1.12.0
imagePullPolicy: IfNotPresent
name: csi-resizer
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
Expand All @@ -343,9 +358,17 @@ spec:
name: linode
image: linode/linode-blockstorage-csi-driver:latest
name: csi-linode-plugin
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /var/lib/csi/sockets/pluginproxy/
name: socket-dir
securityContext:
seccompProfile:
type: RuntimeDefault
serviceAccount: csi-controller-sa
tolerations:
- effect: NoSchedule
Expand All @@ -357,10 +380,6 @@ spec:
volumes:
- emptyDir: {}
name: socket-dir
- configMap:
defaultMode: 493
name: get-linode-id
name: get-linode-id
---
apiVersion: apps/v1
kind: DaemonSet
Expand Down Expand Up @@ -395,6 +414,11 @@ spec:
fieldPath: spec.nodeName
image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.12.0
name: csi-node-driver-registrar
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /csi
name: plugin-dir
Expand Down Expand Up @@ -424,6 +448,8 @@ spec:
capabilities:
add:
- SYS_ADMIN
drop:
- ALL
privileged: true
volumeMounts:
- mountPath: /csi
Expand All @@ -437,6 +463,9 @@ spec:
name: tmp
hostNetwork: true
priorityClassName: system-node-critical
securityContext:
seccompProfile:
type: RuntimeDefault
serviceAccount: csi-node-sa
tolerations:
- effect: NoSchedule
Expand Down
Loading