feat(chart): make pod and sidecar securityContext configurable

deploy/charts/csi-driver-spiffe/README.md

@@ -580,6 +580,41 @@ resources:
     cpu: 100m
     memory: 128Mi
 ```
+#### **podSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> seccompProfile:
+>   type: RuntimeDefault
+> ```
+
+Pod-level security context for the csi-driver-spiffe DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+
+#### **nodeDriverRegistrarSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> allowPrivilegeEscalation: false
+> capabilities:
+>   drop:
+>     - ALL
+> readOnlyRootFilesystem: true
+> runAsUser: 0
+> ```
+
+Container security context for the node-driver-registrar container.
+
+#### **livenessProbeSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> allowPrivilegeEscalation: false
+> capabilities:
+>   drop:
+>     - ALL
+> readOnlyRootFilesystem: true
+> runAsUser: 0
+> ```
+
+Container security context for the liveness-probe container.
+
 #### **priorityClassName** ~ `string`
 > Default value:
 > ```yaml

deploy/charts/csi-driver-spiffe/templates/daemonset.yaml

@@ -17,8 +17,10 @@ spec:
       annotations:
         kubectl.kubernetes.io/default-container: cert-manager-csi-driver-spiffe
     spec:
+      {{- with .Values.podSecurityContext }}
       securityContext:
-        seccompProfile: { type: RuntimeDefault }
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -28,11 +30,10 @@ spec:
       containers:
 
         - name: node-driver-registrar
+          {{- with .Values.nodeDriverRegistrarSecurityContext }}
           securityContext:
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ "ALL" ] }
-            readOnlyRootFilesystem: true
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: "{{ template "cert-manager-csi-driver-spiffe.image" (tuple .Values.app.driver.nodeDriverRegistrarImage .Values.imageRegistry .Values.imageNamespace .Values.app.driver.nodeDriverRegistrarImage._defaultReference) }}"
           imagePullPolicy: {{ .Values.app.driver.nodeDriverRegistrarImage.pullPolicy }}
           args:
@@ -51,11 +52,10 @@ spec:
               mountPath: /registration
 
         - name: liveness-probe
+          {{- with .Values.livenessProbeSecurityContext }}
           securityContext:
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ "ALL" ] }
-            readOnlyRootFilesystem: true
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: "{{ template "cert-manager-csi-driver-spiffe.image" (tuple .Values.app.driver.livenessProbeImage .Values.imageRegistry .Values.imageNamespace .Values.app.driver.livenessProbeImage._defaultReference) }}"
           imagePullPolicy: {{ .Values.app.driver.livenessProbeImage.pullPolicy }}
           args:
@@ -68,6 +68,9 @@ spec:
               mountPath: /plugin
 
         - name: cert-manager-csi-driver-spiffe
+          # This container mounts pods-mount-dir with mountPropagation: Bidirectional,
+          # which Kubernetes only permits for privileged containers, so it must run
+          # privileged. See https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
           securityContext:
             runAsUser: 0
             privileged: true

deploy/charts/csi-driver-spiffe/tests/securitycontext_test.yaml

@@ -0,0 +1,59 @@
+suite: securityContext configurability
+templates:
+  - daemonset.yaml
+tests:
+  - it: preserves the default securityContext on the cert-manager-csi-driver-spiffe container
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver-spiffe")].securityContext.privileged
+          value: true
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver-spiffe")].securityContext.runAsUser
+          value: 0
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver-spiffe")].securityContext.readOnlyRootFilesystem
+          value: true
+      - contains:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver-spiffe")].securityContext.capabilities.drop
+          content: ALL
+
+  - it: preserves the default securityContext on the sidecar containers
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="liveness-probe")].securityContext.allowPrivilegeEscalation
+          value: false
+
+  - it: preserves the default pod-level securityContext
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+
+  - it: lets operators override a sidecar securityContext
+    set:
+      nodeDriverRegistrarSecurityContext:
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.runAsUser
+          value: 1000
+
+  - it: lets operators override the pod-level securityContext
+    set:
+      podSecurityContext:
+        runAsNonRoot: true
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.fsGroup
+          value: 1000

deploy/charts/csi-driver-spiffe/values.schema.json

@@ -33,12 +33,21 @@
         "imageRegistry": {
           "$ref": "#/$defs/helm-values.imageRegistry"
         },
+        "livenessProbeSecurityContext": {
+          "$ref": "#/$defs/helm-values.livenessProbeSecurityContext"
+        },
+        "nodeDriverRegistrarSecurityContext": {
+          "$ref": "#/$defs/helm-values.nodeDriverRegistrarSecurityContext"
+        },
         "nodeSelector": {
           "$ref": "#/$defs/helm-values.nodeSelector"
         },
         "openshift": {
           "$ref": "#/$defs/helm-values.openshift"
         },
+        "podSecurityContext": {
+          "$ref": "#/$defs/helm-values.podSecurityContext"
+        },
         "priorityClassName": {
           "$ref": "#/$defs/helm-values.priorityClassName"
         },
@@ -723,6 +732,34 @@
       "description": "The container registry used for csi-driver-spiffe images by default. This can include path prefixes (e.g. \"artifactory.example.com/docker\").",
       "type": "string"
     },
+    "helm-values.livenessProbeSecurityContext": {
+      "default": {
+        "allowPrivilegeEscalation": false,
+        "capabilities": {
+          "drop": [
+            "ALL"
+          ]
+        },
+        "readOnlyRootFilesystem": true,
+        "runAsUser": 0
+      },
+      "description": "Container security context for the liveness-probe container.",
+      "type": "object"
+    },
+    "helm-values.nodeDriverRegistrarSecurityContext": {
+      "default": {
+        "allowPrivilegeEscalation": false,
+        "capabilities": {
+          "drop": [
+            "ALL"
+          ]
+        },
+        "readOnlyRootFilesystem": true,
+        "runAsUser": 0
+      },
+      "description": "Container security context for the node-driver-registrar container.",
+      "type": "object"
+    },
     "helm-values.nodeSelector": {
       "default": {
         "kubernetes.io/os": "linux"
@@ -760,6 +797,15 @@
       "description": "Name of the SecurityContextConstraints to create RBAC for.",
       "type": "string"
     },
+    "helm-values.podSecurityContext": {
+      "default": {
+        "seccompProfile": {
+          "type": "RuntimeDefault"
+        }
+      },
+      "description": "Pod-level security context for the csi-driver-spiffe DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
+      "type": "object"
+    },
     "helm-values.priorityClassName": {
       "default": "",
       "description": "Optional priority class to be used for the csi-driver pods.",

deploy/charts/csi-driver-spiffe/values.yaml

@@ -350,6 +350,33 @@ app:
     #      memory: 128Mi
     resources: {}
 
+# Pod-level security context for the csi-driver-spiffe DaemonSet pods.
+# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+# +docs:property
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+
+# Container security context for the node-driver-registrar container.
+# +docs:property
+nodeDriverRegistrarSecurityContext:
+  runAsUser: 0
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+
+# Container security context for the liveness-probe container.
+# +docs:property
+livenessProbeSecurityContext:
+  runAsUser: 0
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+
 # Optional priority class to be used for the csi-driver pods.
 priorityClassName: ""