CSI: run all containers as privileged in daemonset pods

On systems with SELinux enabled, non-privileged containers
can't access data of privileged containers. Since the socket
is exposed by privileged containers, all sidecars must be
privileged too. This is needed only for containers running
in daemonset as we are using bidirectional mounts in daemonset

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
(cherry picked from commit e0cc7740f6)
This commit is contained in:
Madhu Rajanna 2020-01-13 09:44:18 +05:30 committed by Madhu Rajanna
parent a816d41e4f
commit f4d05a3ef9
6 changed files with 42 additions and 0 deletions

View File

@ -31,6 +31,11 @@ spec:
dnsPolicy: ClusterFirstWithHostNet
containers:
- name: driver-registrar
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
image: "{{ .Values.nodeplugin.registrar.image.repository }}:{{ .Values.nodeplugin.registrar.image.tag }}"
imagePullPolicy: {{ .Values.nodeplugin.registrar.image.pullPolicy }}
args:
@ -127,6 +132,8 @@ spec:
{{ toYaml .Values.nodeplugin.plugin.resources | indent 12 }}
{{- if .Values.nodeplugin.httpMetrics.enabled }}
- name: liveness-prometheus
securityContext:
privileged: true
image: "{{ .Values.nodeplugin.plugin.image.repository }}:{{ .Values.nodeplugin.plugin.image.tag }}"
imagePullPolicy: {{ .Values.nodeplugin.plugin.image.pullPolicy }}
args:

View File

@ -34,6 +34,11 @@ spec:
dnsPolicy: ClusterFirstWithHostNet
containers:
- name: driver-registrar
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
image: "{{ .Values.nodeplugin.registrar.image.repository }}:{{ .Values.nodeplugin.registrar.image.tag }}"
imagePullPolicy: {{ .Values.nodeplugin.registrar.image.pullPolicy }}
args:
@ -126,6 +131,8 @@ spec:
{{ toYaml .Values.nodeplugin.plugin.resources | indent 12 }}
{{- if .Values.nodeplugin.httpMetrics.enabled }}
- name: liveness-prometheus
securityContext:
privileged: true
image: "{{ .Values.nodeplugin.plugin.image.repository }}:{{ .Values.nodeplugin.plugin.image.tag }}"
imagePullPolicy: {{ .Values.nodeplugin.plugin.image.pullPolicy }}
args:

View File

@ -20,6 +20,11 @@ spec:
containers:
- name: driver-registrar
image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
args:
- "--v=5"
- "--csi-address=/csi/csi.sock"
@ -103,6 +108,8 @@ spec:
mountPath: /tmp/csi/keys
- name: liveness-prometheus
image: quay.io/cephcsi/cephcsi:v1.2.2
securityContext:
privileged: true
args:
- "--type=liveness"
- "--endpoint=$(CSI_ENDPOINT)"

View File

@ -20,6 +20,11 @@ spec:
containers:
- name: driver-registrar
image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
args:
- "--v=5"
- "--csi-address=/csi/csi.sock"
@ -102,6 +107,8 @@ spec:
mountPath: /tmp/csi/keys
- name: liveness-prometheus
image: quay.io/cephcsi/cephcsi:v1.2.2
securityContext:
privileged: true
args:
- "--type=liveness"
- "--endpoint=$(CSI_ENDPOINT)"

View File

@ -23,6 +23,11 @@ spec:
containers:
- name: driver-registrar
image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
args:
- "--v=5"
- "--csi-address=/csi/csi.sock"
@ -97,6 +102,8 @@ spec:
mountPath: /tmp/csi/keys
- name: liveness-prometheus
image: quay.io/cephcsi/cephcsi:v1.2.2
securityContext:
privileged: true
args:
- "--type=liveness"
- "--endpoint=$(CSI_ENDPOINT)"

View File

@ -23,6 +23,11 @@ spec:
containers:
- name: driver-registrar
image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
securityContext:
privileged: true
args:
- "--v=5"
- "--csi-address=/csi/csi.sock"
@ -101,6 +106,8 @@ spec:
mountPath: /tmp/csi/keys
- name: liveness-prometheus
image: quay.io/cephcsi/cephcsi:v1.2.2
securityContext:
privileged: true
args:
- "--type=liveness"
- "--endpoint=$(CSI_ENDPOINT)"