feat(chart): make pod and sidecar securityContext configurable

deploy/charts/csi-driver/README.md

@@ -407,6 +407,41 @@ Optional additional annotations to add to the csi-driver pods.
 > ```
 
 Optional additional labels to add to the csi-driver pods.
+#### **podSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> seccompProfile:
+>   type: RuntimeDefault
+> ```
+
+Pod-level security context for the csi-driver DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+
+#### **nodeDriverRegistrarSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> allowPrivilegeEscalation: false
+> capabilities:
+>   drop:
+>     - ALL
+> readOnlyRootFilesystem: true
+> runAsUser: 0
+> ```
+
+Container security context for the node-driver-registrar container.
+
+#### **livenessProbeSecurityContext** ~ `object`
+> Default value:
+> ```yaml
+> allowPrivilegeEscalation: false
+> capabilities:
+>   drop:
+>     - ALL
+> readOnlyRootFilesystem: true
+> runAsUser: 0
+> ```
+
+Container security context for the liveness-probe container.
+
 #### **resources** ~ `object`
 > Default value:
 > ```yaml

deploy/charts/csi-driver/templates/daemonset.yaml

@@ -27,8 +27,10 @@ spec:
           {{- toYaml .Values.podAnnotations | nindent 8 }}
         {{- end }}
     spec:
+      {{- with .Values.podSecurityContext }}
       securityContext:
-        seccompProfile: { type: RuntimeDefault }
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -42,11 +44,10 @@ spec:
       containers:
 
         - name: node-driver-registrar
+          {{- with .Values.nodeDriverRegistrarSecurityContext }}
           securityContext:
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ "ALL" ] }
-            readOnlyRootFilesystem: true
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: "{{ template "cert-manager-csi-driver.image" (tuple .Values.nodeDriverRegistrarImage .Values.imageRegistry .Values.imageNamespace .Values.nodeDriverRegistrarImage._defaultReference) }}"
           imagePullPolicy: {{ .Values.nodeDriverRegistrarImage.pullPolicy }}
           args:
@@ -65,11 +66,10 @@ spec:
               mountPath: /registration
 
         - name: liveness-probe
+          {{- with .Values.livenessProbeSecurityContext }}
           securityContext:
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ "ALL" ] }
-            readOnlyRootFilesystem: true
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: "{{ template "cert-manager-csi-driver.image" (tuple .Values.livenessProbeImage .Values.imageRegistry .Values.imageNamespace .Values.livenessProbeImage._defaultReference) }}"
           imagePullPolicy: {{ .Values.livenessProbeImage.pullPolicy }}
           args:
@@ -82,6 +82,10 @@ spec:
               mountPath: /plugin
 
         - name: cert-manager-csi-driver
+          # This container mounts pods-mount-dir and csi-data-dir with
+          # mountPropagation: Bidirectional, which Kubernetes only permits for
+          # privileged containers, so it must run privileged. See
+          # https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
           securityContext:
             runAsUser: 0
             privileged: true

deploy/charts/csi-driver/tests/securitycontext_test.yaml

@@ -0,0 +1,59 @@
+suite: securityContext configurability
+templates:
+  - daemonset.yaml
+tests:
+  - it: preserves the default securityContext on the cert-manager-csi-driver container
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.privileged
+          value: true
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.runAsUser
+          value: 0
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.readOnlyRootFilesystem
+          value: true
+      - contains:
+          path: spec.template.spec.containers[?(@.name=="cert-manager-csi-driver")].securityContext.capabilities.drop
+          content: ALL
+
+  - it: preserves the default securityContext on the sidecar containers
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="liveness-probe")].securityContext.allowPrivilegeEscalation
+          value: false
+
+  - it: preserves the default pod-level securityContext
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+
+  - it: lets operators override a sidecar securityContext
+    set:
+      nodeDriverRegistrarSecurityContext:
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=="node-driver-registrar")].securityContext.runAsUser
+          value: 1000
+
+  - it: lets operators override the pod-level securityContext
+    set:
+      podSecurityContext:
+        runAsNonRoot: true
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+    asserts:
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.fsGroup
+          value: 1000

deploy/charts/csi-driver/values.schema.json

@@ -36,12 +36,18 @@
         "livenessProbeImage": {
           "$ref": "#/$defs/helm-values.livenessProbeImage"
         },
+        "livenessProbeSecurityContext": {
+          "$ref": "#/$defs/helm-values.livenessProbeSecurityContext"
+        },
         "metrics": {
           "$ref": "#/$defs/helm-values.metrics"
         },
         "nodeDriverRegistrarImage": {
           "$ref": "#/$defs/helm-values.nodeDriverRegistrarImage"
         },
+        "nodeDriverRegistrarSecurityContext": {
+          "$ref": "#/$defs/helm-values.nodeDriverRegistrarSecurityContext"
+        },
         "nodeSelector": {
           "$ref": "#/$defs/helm-values.nodeSelector"
         },
@@ -54,6 +60,9 @@
         "podLabels": {
           "$ref": "#/$defs/helm-values.podLabels"
         },
+        "podSecurityContext": {
+          "$ref": "#/$defs/helm-values.podSecurityContext"
+        },
         "priorityClassName": {
           "$ref": "#/$defs/helm-values.priorityClassName"
         },
@@ -320,6 +329,20 @@
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.livenessProbeSecurityContext": {
+      "default": {
+        "allowPrivilegeEscalation": false,
+        "capabilities": {
+          "drop": [
+            "ALL"
+          ]
+        },
+        "readOnlyRootFilesystem": true,
+        "runAsUser": 0
+      },
+      "description": "Container security context for the liveness-probe container.",
+      "type": "object"
+    },
     "helm-values.metrics": {
       "additionalProperties": false,
       "properties": {
@@ -481,6 +504,20 @@
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.nodeDriverRegistrarSecurityContext": {
+      "default": {
+        "allowPrivilegeEscalation": false,
+        "capabilities": {
+          "drop": [
+            "ALL"
+          ]
+        },
+        "readOnlyRootFilesystem": true,
+        "runAsUser": 0
+      },
+      "description": "Container security context for the node-driver-registrar container.",
+      "type": "object"
+    },
     "helm-values.nodeSelector": {
       "default": {
         "kubernetes.io/os": "linux"
@@ -528,6 +565,15 @@
       "description": "Optional additional labels to add to the csi-driver pods.",
       "type": "object"
     },
+    "helm-values.podSecurityContext": {
+      "default": {
+        "seccompProfile": {
+          "type": "RuntimeDefault"
+        }
+      },
+      "description": "Pod-level security context for the csi-driver DaemonSet pods. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
+      "type": "object"
+    },
     "helm-values.priorityClassName": {
       "default": "",
       "description": "Optional priority class to be used for the csi-driver pods.",

deploy/charts/csi-driver/values.yaml

@@ -256,6 +256,33 @@ podAnnotations: {}
 # Optional additional labels to add to the csi-driver pods.
 podLabels: {}
 
+# Pod-level security context for the csi-driver DaemonSet pods.
+# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+# +docs:property
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+
+# Container security context for the node-driver-registrar container.
+# +docs:property
+nodeDriverRegistrarSecurityContext:
+  runAsUser: 0
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+
+# Container security context for the liveness-probe container.
+# +docs:property
+livenessProbeSecurityContext:
+  runAsUser: 0
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+
 # Kubernetes pod resources requests/limits for cert-manager-csi-driver.
 #
 # For example: