mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-18 02:50:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

helm: CSIDriver add labels and seLinuxMount disabling method

Browse Source 
Signed-off-by: Ruslan Khizhnyak <rkhizhnyak@ptsecurity.com>
This commit is contained in:
Ruslan Khizhnyak 2024-03-21 01:58:05 +03:00 committed by mergify[bot]
parent cd18490451
commit d56c9abbce
4 changed files with 35 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
charts/ceph-csi-cephfs/templates/csidriver-crd.yaml
View File

@ -2,10 +2,16 @@ apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
name: {{ .Values.driverName }}
labels:
app: {{ include "ceph-csi-cephfs.name" . }}
chart: {{ include "ceph-csi-cephfs.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- with .Values.commonLabels }}{{ toYaml . | trim | nindent 4 }}{{- end }}
spec:
attachRequired: false
podInfoOnMount: false
fsGroupPolicy: {{ default "File" .Values.CSIDriver.fsGroupPolicy }}
{{- if semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version }}
fsGroupPolicy: {{ .Values.CSIDriver.fsGroupPolicy }}
{{- if and (semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version) .Values.seLinuxMount }}
seLinuxMount: true
{{- end }}

1
charts/ceph-csi-cephfs/values.yaml
View File

@ -57,6 +57,7 @@ sidecarLogLevel: 1
# accessModes contains ReadWriteOnce.
CSIDriver:
fsGroupPolicy: "File"
seLinuxMount: true
nodeplugin:
name: nodeplugin

10
charts/ceph-csi-rbd/templates/csidriver-crd.yaml
View File

@ -2,10 +2,16 @@ apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
name: {{ .Values.driverName }}
labels:
app: {{ include "ceph-csi-rbd.name" . }}
chart: {{ include "ceph-csi-rbd.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- with .Values.commonLabels }}{{ toYaml . | trim | nindent 4 }}{{- end }}
spec:
attachRequired: true
podInfoOnMount: false
fsGroupPolicy: File
{{- if semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version }}
fsGroupPolicy: {{ .Values.CSIDriver.fsGroupPolicy }}
{{- if and (semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version) .Values.seLinuxMount }}
seLinuxMount: true
{{- end }}

18
charts/ceph-csi-rbd/values.yaml
View File

@ -69,6 +69,24 @@ logLevel: 5
# sidecarLogLevel is the variable for Kubernetes sidecar container's log level
sidecarLogLevel: 1
# Set fsGroupPolicy for CSI Driver object spec
# https://kubernetes-csi.github.io/docs/support-fsgroup.html
# The following modes are supported:
# - None: Indicates that volumes will be mounted with no modifications, as the
# CSI volume driver does not support these operations.
# - File: Indicates that the CSI volume driver supports volume ownership and
# permission change via fsGroup, and Kubernetes may use fsGroup to change
# permissions and ownership of the volume to match user requested fsGroup in
# the pod's SecurityPolicy regardless of fstype or access mode.
# - ReadWriteOnceWithFSType: Indicates that volumes will be examined to
# determine if volume ownership and permissions should be modified to match
# the pod's security policy.
# Changes will only occur if the fsType is defined and the persistent volume's
# accessModes contains ReadWriteOnce.
CSIDriver:
fsGroupPolicy: "File"
seLinuxMount: true
nodeplugin:
name: nodeplugin
# set user created priorityclassName for csi plugin pods. default is