panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add configurable hostNetwork support to spiffe-csi-driver (#769)

Browse Source 
Signed-off-by: aniket patel <[email protected]>
This commit is contained in:
anhpatel
2026-03-10 14:09:31 -07:00
committed by GitHub
parent 2de363a4a6
commit 60899fc9d2
5 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+1
View File
@@ -54,6 +54,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `podLabels` | Labels to add to pods | `{}` | | `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `securityContext` | Security context for CSI driver containers | `{}` | | `securityContext` | Security context for CSI driver containers | `{}` |
| `hostNetwork` | Enable hostNetwork for the DaemonSet | `false` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `tolerations` | Tolerations for CSI driver pods | `[]` | | `tolerations` | Tolerations for CSI driver pods | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+3
View File
@@ -52,6 +52,9 @@ spec:
tolerations: tolerations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- if .Values.hostNetwork }}
hostNetwork: true
{{- end }}
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }} {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
securityContext: securityContext:
charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml
+2 -2
View File
@@ -3,7 +3,7 @@
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} {{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
apiVersion: security.openshift.io/v1 apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints kind: SecurityContextConstraints
allowHostPorts: false allowHostPorts: {{ .Values.hostNetwork }}
priority: null priority: null
requiredDropCapabilities: requiredDropCapabilities:
{{- if eq (.Values.restrictedScc.version | toString) "2" }} {{- if eq (.Values.restrictedScc.version | toString) "2" }}
@@ -50,7 +50,7 @@ volumes:
- projected - projected
- secret - secret
allowHostPID: false allowHostPID: false
allowHostNetwork: false allowHostNetwork: {{ .Values.hostNetwork }}
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
{{- if eq (.Values.restrictedScc.version | toString) "2" }} {{- if eq (.Values.restrictedScc.version | toString) "2" }}
allowedCapabilities: allowedCapabilities:
charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml
+2 -2
View File
@@ -19,9 +19,9 @@ volumes:
allowedCapabilities: null allowedCapabilities: null
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: false allowHostIPC: false
allowHostNetwork: false allowHostNetwork: {{ .Values.hostNetwork }}
allowHostPID: false allowHostPID: false
allowHostPorts: false allowHostPorts: {{ .Values.hostNetwork }}
allowPrivilegeEscalation: true allowPrivilegeEscalation: true
allowPrivilegedContainer: true allowPrivilegedContainer: true
defaultAddCapabilities: null defaultAddCapabilities: null
charts/spire/charts/spiffe-csi-driver/values.yaml
+3
View File
@@ -112,6 +112,9 @@ securityContext:
# drop: # drop:
# - ALL # - ALL
## @param hostNetwork Enable hostNetwork for the DaemonSet
hostNetwork: false
## @param nodeSelector [object] Node selector for CSI driver pods ## @param nodeSelector [object] Node selector for CSI driver pods
nodeSelector: {} nodeSelector: {}