Add configurable hostNetwork support to spiffe-csi-driver (#769)

Signed-off-by: aniket patel <[email protected]>
2026-03-10 14:09:31 -07:00
parent 2de363a4a6
commit 60899fc9d2
5 changed files with 11 additions and 4 deletions
@@ -54,6 +54,7 @@ A Helm chart to install the SPIFFE CSI driver.
 | `podLabels`                                   | Labels to add to pods                                                                                                                                                    | `{}`                                        |
 | `podSecurityContext`                          | Security context for CSI driver pods                                                                                                                                     | `{}`                                        |
 | `securityContext`                             | Security context for CSI driver containers                                                                                                                               | `{}`                                        |
+| `hostNetwork`                                 | Enable hostNetwork for the DaemonSet                                                                                                                                     | `false`                                     |
 | `nodeSelector`                                | Node selector for CSI driver pods                                                                                                                                        | `{}`                                        |
 | `tolerations`                                 | Tolerations for CSI driver pods                                                                                                                                          | `[]`                                        |
 | `affinity`                                    | Node affinity                                                                                                                                                            | `{}`                                        |
@@ -52,6 +52,9 @@ spec:
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if .Values.hostNetwork }}
+      hostNetwork: true
+      {{- end }}
      {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
      {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
      securityContext:
@@ -3,7 +3,7 @@
 {{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
-allowHostPorts: false
+allowHostPorts: {{ .Values.hostNetwork }}
 priority: null
 requiredDropCapabilities:
 {{- if eq (.Values.restrictedScc.version | toString) "2" }}
@@ -50,7 +50,7 @@ volumes:
  - projected
  - secret
 allowHostPID: false
-allowHostNetwork: false
+allowHostNetwork: {{ .Values.hostNetwork }}
 allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
 {{- if eq (.Values.restrictedScc.version | toString) "2" }}
 allowedCapabilities:
@@ -19,9 +19,9 @@ volumes:
 allowedCapabilities: null
 allowHostDirVolumePlugin: true
 allowHostIPC: false
-allowHostNetwork: false
+allowHostNetwork: {{ .Values.hostNetwork }}
 allowHostPID: false
-allowHostPorts: false
+allowHostPorts: {{ .Values.hostNetwork }}
 allowPrivilegeEscalation: true
 allowPrivilegedContainer: true
 defaultAddCapabilities: null
@@ -112,6 +112,9 @@ securityContext:
  #   drop:
  #   - ALL

+## @param hostNetwork Enable hostNetwork for the DaemonSet
+hostNetwork: false
+
 ## @param nodeSelector [object] Node selector for CSI driver pods
 nodeSelector: {}