panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CSI driver: Support setting podSecurityContext and securityContext (#642)

Browse Source 
* Allow for both the pod security context and container security contexts to be overriden through the spiffe-csi-driver values file

Signed-off-by: Alec Holmes <[email protected]>

* newline

Signed-off-by: Alec Holmes <[email protected]>

* fix space

Signed-off-by: Alec Holmes <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Alec Holmes <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Alec Holmes
2026-01-23 20:55:14 +00:00
committed by GitHub
co-authored by kfox1111 Faisal Memon
parent 813203a4d2
commit f8f1e21f7d
3 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+1 -2
View File
@@ -52,8 +52,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
| `securityContext.privileged` | Flag for specifying privileged mode | `true` |
| `securityContext` | Security context for CSI driver containers | `{}` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `tolerations` | Tolerations for CSI driver pods | `[]` |
| `affinity` | Node affinity | `{}` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+7 -9
View File
@@ -1,3 +1,6 @@
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
{{- $podSecurityContext := deepCopy .Values.podSecurityContext }}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
@@ -48,6 +51,8 @@ spec:
{{- end }}
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
securityContext:
{{- toYaml $podSecurityContext | nindent 8 }}
initContainers:
{{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
- name: set-context
@@ -59,10 +64,7 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.selinux.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.selinux.image.pullPolicy }}
securityContext:
capabilities:
drop:
- all
privileged: true
{{- $mainSecurityContext | toYaml | nindent 12 }}
volumeMounts:
- name: spire-agent-socket-dir
mountPath: /spire-agent-socket
@@ -110,11 +112,7 @@ spec:
mountPropagation: Bidirectional
name: mountpoint-dir
securityContext:
readOnlyRootFilesystem: true
capabilities:
drop:
- all
privileged: true
{{- $mainSecurityContext | toYaml | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
# This container runs the CSI Node Driver Registrar which takes care
charts/spire/charts/spiffe-csi-driver/values.yaml
+4 -2
View File
@@ -95,12 +95,14 @@ podAnnotations: {}
podSecurityContext: {}
# fsGroup: 2000
## @param securityContext.readOnlyRootFilesystem Flag for read only root filesystem
## @param securityContext.privileged Flag for specifying privileged mode
## @param securityContext [object] Security context for CSI driver containers
##
securityContext:
readOnlyRootFilesystem: true
privileged: true
capabilities:
drop:
- ALL
# runAsNonRoot: true
# runAsUser: 1000
# capabilities: