CSI: run all containers as privileged in daemonset pods

On systems with SELinux enabled, non-privileged containers
can't access data of privileged containers. Since the socket
is exposed by privileged containers, all sidecars must be
privileged too. This is needed only for containers running
in daemonset as we are using bidirectional mounts in daemonset

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit e0cc7740f6db86ba9a5f37e850ec9cd0f614315c)

charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml

@@ -31,6 +31,11 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: driver-registrar
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           image: "{{ .Values.nodeplugin.registrar.image.repository }}:{{ .Values.nodeplugin.registrar.image.tag }}"
           imagePullPolicy: {{ .Values.nodeplugin.registrar.image.pullPolicy }}
           args:
@@ -127,6 +132,8 @@ spec:
 {{ toYaml .Values.nodeplugin.plugin.resources | indent 12 }}
 {{- if .Values.nodeplugin.httpMetrics.enabled }}
         - name: liveness-prometheus
+          securityContext:
+            privileged: true
           image: "{{ .Values.nodeplugin.plugin.image.repository }}:{{ .Values.nodeplugin.plugin.image.tag }}"
           imagePullPolicy: {{ .Values.nodeplugin.plugin.image.pullPolicy }}
           args:

charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml

@@ -34,6 +34,11 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: driver-registrar
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           image: "{{ .Values.nodeplugin.registrar.image.repository }}:{{ .Values.nodeplugin.registrar.image.tag }}"
           imagePullPolicy: {{ .Values.nodeplugin.registrar.image.pullPolicy }}
           args:
@@ -126,6 +131,8 @@ spec:
 {{ toYaml .Values.nodeplugin.plugin.resources | indent 12 }}
 {{- if .Values.nodeplugin.httpMetrics.enabled }}
         - name: liveness-prometheus
+          securityContext:
+            privileged: true
           image: "{{ .Values.nodeplugin.plugin.image.repository }}:{{ .Values.nodeplugin.plugin.image.tag }}"
           imagePullPolicy: {{ .Values.nodeplugin.plugin.image.pullPolicy }}
           args:

deploy/cephfs/kubernetes/v1.13/csi-cephfsplugin.yaml

@@ -20,6 +20,11 @@ spec:
       containers:
         - name: driver-registrar
           image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           args:
             - "--v=5"
             - "--csi-address=/csi/csi.sock"
@@ -103,6 +108,8 @@ spec:
               mountPath: /tmp/csi/keys
         - name: liveness-prometheus
           image: quay.io/cephcsi/cephcsi:v1.2.2
+          securityContext:
+            privileged: true
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

deploy/cephfs/kubernetes/v1.14+/csi-cephfsplugin.yaml

@@ -20,6 +20,11 @@ spec:
       containers:
         - name: driver-registrar
           image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           args:
             - "--v=5"
             - "--csi-address=/csi/csi.sock"
@@ -102,6 +107,8 @@ spec:
               mountPath: /tmp/csi/keys
         - name: liveness-prometheus
           image: quay.io/cephcsi/cephcsi:v1.2.2
+          securityContext:
+            privileged: true
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

deploy/rbd/kubernetes/v1.13/csi-rbdplugin.yaml

@@ -23,6 +23,11 @@ spec:
       containers:
         - name: driver-registrar
           image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           args:
             - "--v=5"
             - "--csi-address=/csi/csi.sock"
@@ -97,6 +102,8 @@ spec:
               mountPath: /tmp/csi/keys
         - name: liveness-prometheus
           image: quay.io/cephcsi/cephcsi:v1.2.2
+          securityContext:
+            privileged: true
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

deploy/rbd/kubernetes/v1.14+/csi-rbdplugin.yaml

@@ -23,6 +23,11 @@ spec:
       containers:
         - name: driver-registrar
           image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
+          # This is necessary only for systems with SELinux, where
+          # non-privileged sidecar containers cannot access unix domain socket
+          # created by privileged CSI driver container.
+          securityContext:
+            privileged: true
           args:
             - "--v=5"
             - "--csi-address=/csi/csi.sock"
@@ -101,6 +106,8 @@ spec:
               mountPath: /tmp/csi/keys
         - name: liveness-prometheus
           image: quay.io/cephcsi/cephcsi:v1.2.2
+          securityContext:
+            privileged: true
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"