panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CSI driver: Support setting podSecurityContext and securityContext (#642)

Browse Source 
* Allow for both the pod security context and container security contexts to be overriden through the spiffe-csi-driver values file

Signed-off-by: Alec Holmes <[email protected]>

* newline

Signed-off-by: Alec Holmes <[email protected]>

* fix space

Signed-off-by: Alec Holmes <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Alec Holmes <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Alec Holmes
2026-01-23 20:55:14 +00:00
committed by GitHub
co-authored by kfox1111 Faisal Memon
parent 813203a4d2
commit f8f1e21f7d
3 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+1 -2
View File
@@ -52,8 +52,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | | `securityContext` | Security context for CSI driver containers | `{}` |
| `securityContext.privileged` | Flag for specifying privileged mode | `true` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `tolerations` | Tolerations for CSI driver pods | `[]` | | `tolerations` | Tolerations for CSI driver pods | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+7 -9
View File
@@ -1,3 +1,6 @@
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
{{- $podSecurityContext := deepCopy .Values.podSecurityContext }}
---
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
@@ -48,6 +51,8 @@ spec:
{{- end }} {{- end }}
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }} {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
securityContext:
{{- toYaml $podSecurityContext | nindent 8 }}
initContainers: initContainers:
{{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }} {{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
- name: set-context - name: set-context
@@ -59,10 +64,7 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.selinux.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.selinux.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.selinux.image.pullPolicy }} imagePullPolicy: {{ .Values.selinux.image.pullPolicy }}
securityContext: securityContext:
capabilities: {{- $mainSecurityContext | toYaml | nindent 12 }}
drop:
- all
privileged: true
volumeMounts: volumeMounts:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: /spire-agent-socket mountPath: /spire-agent-socket
@@ -110,11 +112,7 @@ spec:
mountPropagation: Bidirectional mountPropagation: Bidirectional
name: mountpoint-dir name: mountpoint-dir
securityContext: securityContext:
readOnlyRootFilesystem: true {{- $mainSecurityContext | toYaml | nindent 12 }}
capabilities:
drop:
- all
privileged: true
resources: resources:
{{- toYaml .Values.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
# This container runs the CSI Node Driver Registrar which takes care # This container runs the CSI Node Driver Registrar which takes care
charts/spire/charts/spiffe-csi-driver/values.yaml
+4 -2
View File
@@ -95,12 +95,14 @@ podAnnotations: {}
podSecurityContext: {} podSecurityContext: {}
# fsGroup: 2000 # fsGroup: 2000
## @param securityContext.readOnlyRootFilesystem Flag for read only root filesystem ## @param securityContext [object] Security context for CSI driver containers
## @param securityContext.privileged Flag for specifying privileged mode
## ##
securityContext: securityContext:
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
privileged: true privileged: true
capabilities:
drop:
- ALL
# runAsNonRoot: true # runAsNonRoot: true
# runAsUser: 1000 # runAsUser: 1000
# capabilities: # capabilities: