diff --git a/deploy/charts/csi-driver/README.md b/deploy/charts/csi-driver/README.md index f4690ee5..ffc4e25b 100644 --- a/deploy/charts/csi-driver/README.md +++ b/deploy/charts/csi-driver/README.md @@ -407,6 +407,41 @@ Optional additional annotations to add to the csi-driver pods. > ``` Optional additional labels to add to the csi-driver pods. +#### **podSecurityContext** ~ `object` +> Default value: +> ```yaml +> seccompProfile: +> type: RuntimeDefault +> ``` + +Pod-level security context for the csi-driver DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). + +#### **nodeDriverRegistrarSecurityContext** ~ `object` +> Default value: +> ```yaml +> allowPrivilegeEscalation: false +> capabilities: +> drop: +> - ALL +> readOnlyRootFilesystem: true +> runAsUser: 0 +> ``` + +Container security context for the node-driver-registrar container. + +#### **livenessProbeSecurityContext** ~ `object` +> Default value: +> ```yaml +> allowPrivilegeEscalation: false +> capabilities: +> drop: +> - ALL +> readOnlyRootFilesystem: true +> runAsUser: 0 +> ``` + +Container security context for the liveness-probe container. + #### **resources** ~ `object` > Default value: > ```yaml diff --git a/deploy/charts/csi-driver/templates/daemonset.yaml b/deploy/charts/csi-driver/templates/daemonset.yaml index 8d4aacac..79d75c2b 100644 --- a/deploy/charts/csi-driver/templates/daemonset.yaml +++ b/deploy/charts/csi-driver/templates/daemonset.yaml @@ -27,8 +27,10 @@ spec: {{- toYaml .Values.podAnnotations | nindent 8 }} {{- end }} spec: + {{- with .Values.podSecurityContext }} securityContext: - seccompProfile: { type: RuntimeDefault } + {{- toYaml . | nindent 8 }} + {{- end }} {{- with .Values.imagePullSecrets }} imagePullSecrets: @@ -42,11 +44,10 @@ spec: containers: - name: node-driver-registrar + {{- with .Values.nodeDriverRegistrarSecurityContext }} securityContext: - runAsUser: 0 - allowPrivilegeEscalation: false - capabilities: { drop: [ "ALL" ] } - readOnlyRootFilesystem: true + {{- toYaml . | nindent 12 }} + {{- end }} image: "{{ template "cert-manager-csi-driver.image" (tuple .Values.nodeDriverRegistrarImage .Values.imageRegistry .Values.imageNamespace .Values.nodeDriverRegistrarImage._defaultReference) }}" imagePullPolicy: {{ .Values.nodeDriverRegistrarImage.pullPolicy }} args: @@ -65,11 +66,10 @@ spec: mountPath: /registration - name: liveness-probe + {{- with .Values.livenessProbeSecurityContext }} securityContext: - runAsUser: 0 - allowPrivilegeEscalation: false - capabilities: { drop: [ "ALL" ] } - readOnlyRootFilesystem: true + {{- toYaml . | nindent 12 }} + {{- end }} image: "{{ template "cert-manager-csi-driver.image" (tuple .Values.livenessProbeImage .Values.imageRegistry .Values.imageNamespace .Values.livenessProbeImage._defaultReference) }}" imagePullPolicy: {{ .Values.livenessProbeImage.pullPolicy }} args: @@ -82,6 +82,10 @@ spec: mountPath: /plugin - name: cert-manager-csi-driver + # This container mounts pods-mount-dir and csi-data-dir with + # mountPropagation: Bidirectional, which Kubernetes only permits for + # privileged containers, so it must run privileged. See + # https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation securityContext: runAsUser: 0 privileged: true diff --git a/deploy/charts/csi-driver/tests/securitycontext_test.yaml b/deploy/charts/csi-driver/tests/securitycontext_test.yaml new file mode 100644 index 00000000..fa7d9720 --- /dev/null +++ b/deploy/charts/csi-driver/tests/securitycontext_test.yaml @@ -0,0 +1,59 @@ +suite: securityContext configurability +templates: + - daemonset.yaml +tests: + - it: preserves the default securityContext on the cert-manager-csi-driver container + asserts: + - equal: + path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.privileged + value: true + - equal: + path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.runAsUser + value: 0 + - equal: + path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.readOnlyRootFilesystem + value: true + - contains: + path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.capabilities.drop + content: ALL + + - it: preserves the default securityContext on the sidecar containers + asserts: + - equal: + path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.allowPrivilegeEscalation + value: false + - equal: + path: spec.template.spec.containers[?(@.name=="liveness-probe")].securityContext.allowPrivilegeEscalation + value: false + + - it: preserves the default pod-level securityContext + asserts: + - equal: + path: spec.template.spec.securityContext.seccompProfile.type + value: RuntimeDefault + + - it: lets operators override a sidecar securityContext + set: + nodeDriverRegistrarSecurityContext: + runAsUser: 1000 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + asserts: + - equal: + path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.runAsUser + value: 1000 + + - it: lets operators override the pod-level securityContext + set: + podSecurityContext: + runAsNonRoot: true + fsGroup: 1000 + seccompProfile: + type: RuntimeDefault + asserts: + - equal: + path: spec.template.spec.securityContext.runAsNonRoot + value: true + - equal: + path: spec.template.spec.securityContext.fsGroup + value: 1000 diff --git a/deploy/charts/csi-driver/values.schema.json b/deploy/charts/csi-driver/values.schema.json index c669b53a..20c89239 100644 --- a/deploy/charts/csi-driver/values.schema.json +++ b/deploy/charts/csi-driver/values.schema.json @@ -36,12 +36,18 @@ "livenessProbeImage": { "$ref": "#/$defs/helm-values.livenessProbeImage" }, + "livenessProbeSecurityContext": { + "$ref": "#/$defs/helm-values.livenessProbeSecurityContext" + }, "metrics": { "$ref": "#/$defs/helm-values.metrics" }, "nodeDriverRegistrarImage": { "$ref": "#/$defs/helm-values.nodeDriverRegistrarImage" }, + "nodeDriverRegistrarSecurityContext": { + "$ref": "#/$defs/helm-values.nodeDriverRegistrarSecurityContext" + }, "nodeSelector": { "$ref": "#/$defs/helm-values.nodeSelector" }, @@ -54,6 +60,9 @@ "podLabels": { "$ref": "#/$defs/helm-values.podLabels" }, + "podSecurityContext": { + "$ref": "#/$defs/helm-values.podSecurityContext" + }, "priorityClassName": { "$ref": "#/$defs/helm-values.priorityClassName" }, @@ -320,6 +329,20 @@ "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.", "type": "string" }, + "helm-values.livenessProbeSecurityContext": { + "default": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true, + "runAsUser": 0 + }, + "description": "Container security context for the liveness-probe container.", + "type": "object" + }, "helm-values.metrics": { "additionalProperties": false, "properties": { @@ -481,6 +504,20 @@ "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.", "type": "string" }, + "helm-values.nodeDriverRegistrarSecurityContext": { + "default": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true, + "runAsUser": 0 + }, + "description": "Container security context for the node-driver-registrar container.", + "type": "object" + }, "helm-values.nodeSelector": { "default": { "kubernetes.io/os": "linux" @@ -528,6 +565,15 @@ "description": "Optional additional labels to add to the csi-driver pods.", "type": "object" }, + "helm-values.podSecurityContext": { + "default": { + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "description": "Pod-level security context for the csi-driver DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).", + "type": "object" + }, "helm-values.priorityClassName": { "default": "", "description": "Optional priority class to be used for the csi-driver pods.", diff --git a/deploy/charts/csi-driver/values.yaml b/deploy/charts/csi-driver/values.yaml index 921b3ad8..30b6eec8 100644 --- a/deploy/charts/csi-driver/values.yaml +++ b/deploy/charts/csi-driver/values.yaml @@ -256,6 +256,33 @@ podAnnotations: {} # Optional additional labels to add to the csi-driver pods. podLabels: {} +# Pod-level security context for the csi-driver DaemonSet pods. +# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). +# +docs:property +podSecurityContext: + seccompProfile: + type: RuntimeDefault + +# Container security context for the node-driver-registrar container. +# +docs:property +nodeDriverRegistrarSecurityContext: + runAsUser: 0 + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + +# Container security context for the liveness-probe container. +# +docs:property +livenessProbeSecurityContext: + runAsUser: 0 + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + # Kubernetes pod resources requests/limits for cert-manager-csi-driver. # # For example: