From ea42a0e873f911977c5df0c2d45915095d9ed7af Mon Sep 17 00:00:00 2001 From: 1602077 <62025739+1602077@users.noreply.github.com> Date: Wed, 5 Jun 2024 13:27:49 +0200 Subject: [PATCH] deploy: configurable podSecurityContexts in ceph-csi-cephfs pod-level security contexts for nodeplugin daemonset and provisioner deployment can be set via helm values.yaml Signed-off-by: 1602077 <62025739+1602077@users.noreply.github.com> --- PendingReleaseNotes.md | 2 ++ charts/ceph-csi-cephfs/README.md | 2 ++ charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml | 1 + charts/ceph-csi-cephfs/templates/provisioner-deployment.yaml | 1 + charts/ceph-csi-cephfs/values.yaml | 4 ++++ 5 files changed, 10 insertions(+) diff --git a/PendingReleaseNotes.md b/PendingReleaseNotes.md index ade3a3e70..ff18a00f5 100644 --- a/PendingReleaseNotes.md +++ b/PendingReleaseNotes.md @@ -4,4 +4,6 @@ ## Features +- deploy: podSecurityContexts can be configured for ceph-csi-cephfs chart in [PR](https://github.com/ceph/ceph-csi/pull/4664). + ## NOTE diff --git a/charts/ceph-csi-cephfs/README.md b/charts/ceph-csi-cephfs/README.md index 21a04bca7..4ec879e1f 100644 --- a/charts/ceph-csi-cephfs/README.md +++ b/charts/ceph-csi-cephfs/README.md @@ -129,6 +129,7 @@ charts and their default values. | `nodeplugin.plugin.image.repository` | Nodeplugin image repository URL | `quay.io/cephcsi/cephcsi` | | `nodeplugin.plugin.image.tag` | Image tag | `canary` | | `nodeplugin.plugin.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `nodeplugin.podSecurityContext` | Specifies pod-level security context. | `{}` | | `nodeplugin.nodeSelector` | Kubernetes `nodeSelector` to add to the Daemonset | `{}` | | `nodeplugin.tolerations` | List of Kubernetes `tolerations` to add to the Daemonset | `{}` | | `nodeplugin.forcecephkernelclient` | Set to true to enable Ceph Kernel clients on kernel < 4.17 which support quotas | `true` | @@ -163,6 +164,7 @@ charts and their default values. | `provisioner.tolerations` | Specifies the tolerations for provisioner deployment | `{}` | | `provisioner.affinity` | Specifies the affinity for provisioner deployment | `{}` | | `provisioner.podSecurityPolicy.enabled` | Specifies whether podSecurityPolicy is enabled | `false` | +| `provisioner.podSecurityContext` | Specifies pod-level security context. | `{}` | | `provisionerSocketFile` | The filename of the provisioner socket | `csi-provisioner.sock` | | `pluginSocketFile` | The filename of the plugin socket | `csi.sock` | | `readAffinity.enabled` | Enable read affinity for CephFS subvolumes. Recommended to set to true if running kernel 5.8 or newer. | `false` | diff --git a/charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml b/charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml index 252013f99..5da5ca165 100644 --- a/charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml +++ b/charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml @@ -28,6 +28,7 @@ spec: heritage: {{ .Release.Service }} {{- with .Values.commonLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }} spec: + securityContext: {{ toYaml .Values.nodeplugin.podSecurityContext | nindent 8 }} serviceAccountName: {{ include "ceph-csi-cephfs.serviceAccountName.nodeplugin" . }} {{- if .Values.nodeplugin.priorityClassName }} priorityClassName: {{ .Values.nodeplugin.priorityClassName }} diff --git a/charts/ceph-csi-cephfs/templates/provisioner-deployment.yaml b/charts/ceph-csi-cephfs/templates/provisioner-deployment.yaml index 4767866ba..685e39b66 100644 --- a/charts/ceph-csi-cephfs/templates/provisioner-deployment.yaml +++ b/charts/ceph-csi-cephfs/templates/provisioner-deployment.yaml @@ -57,6 +57,7 @@ spec: {{ toYaml .Values.provisioner.affinity | indent 8 -}} {{- end -}} {{- end }} + securityContext: {{ toYaml .Values.provisioner.podSecurityContext | nindent 8 }} serviceAccountName: {{ include "ceph-csi-cephfs.serviceAccountName.provisioner" . }} hostNetwork: {{ .Values.provisioner.enableHostNetwork }} {{- if .Values.provisioner.priorityClassName }} diff --git a/charts/ceph-csi-cephfs/values.yaml b/charts/ceph-csi-cephfs/values.yaml index b13b50524..d0eaaadc8 100644 --- a/charts/ceph-csi-cephfs/values.yaml +++ b/charts/ceph-csi-cephfs/values.yaml @@ -127,6 +127,8 @@ nodeplugin: affinity: {} + podSecurityContext: {} + # Set to true to enable Ceph Kernel clients # on kernel < 4.17 which support quotas # forcecephkernelclient: true @@ -244,6 +246,8 @@ provisioner: affinity: {} + podSecurityContext: {} + # readAffinity: # Enable read affinity for CephFS subvolumes. Recommended to # set to true if running kernel 5.8 or newer.