mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-28 05:57:25 +00:00
Run all csi-hostpath containers as privileged
On systems with SELinux enabled, non-privileged containers can't access data of privileged containers. Since the CSI driver socket is exposed by a privileged container, all sidecars must be privileged too.
This commit is contained in:
parent
f6337c7624
commit
d3c562f7e0
@ -44,6 +44,11 @@ spec:
|
|||||||
args:
|
args:
|
||||||
- --v=5
|
- --v=5
|
||||||
- --csi-address=/csi/csi.sock
|
- --csi-address=/csi/csi.sock
|
||||||
|
securityContext:
|
||||||
|
# This is necessary only for systems with SELinux, where
|
||||||
|
# non-privileged sidecar containers cannot access unix domain socket
|
||||||
|
# created by privileged CSI driver container.
|
||||||
|
privileged: true
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /csi
|
- mountPath: /csi
|
||||||
name: socket-dir
|
name: socket-dir
|
||||||
|
@ -46,6 +46,9 @@ spec:
|
|||||||
- --csi-address=/csi/csi.sock
|
- --csi-address=/csi/csi.sock
|
||||||
- --kubelet-registration-path=/var/lib/kubelet/plugins/csi-hostpath/csi.sock
|
- --kubelet-registration-path=/var/lib/kubelet/plugins/csi-hostpath/csi.sock
|
||||||
securityContext:
|
securityContext:
|
||||||
|
# This is necessary only for systems with SELinux, where
|
||||||
|
# non-privileged sidecar containers cannot access unix domain socket
|
||||||
|
# created by privileged CSI driver container.
|
||||||
privileged: true
|
privileged: true
|
||||||
env:
|
env:
|
||||||
- name: KUBE_NODE_NAME
|
- name: KUBE_NODE_NAME
|
||||||
|
@ -46,6 +46,11 @@ spec:
|
|||||||
- -v=5
|
- -v=5
|
||||||
- --csi-address=/csi/csi.sock
|
- --csi-address=/csi/csi.sock
|
||||||
- --connection-timeout=15s
|
- --connection-timeout=15s
|
||||||
|
securityContext:
|
||||||
|
# This is necessary only for systems with SELinux, where
|
||||||
|
# non-privileged sidecar containers cannot access unix domain socket
|
||||||
|
# created by privileged CSI driver container.
|
||||||
|
privileged: true
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /csi
|
- mountPath: /csi
|
||||||
name: socket-dir
|
name: socket-dir
|
||||||
|
@ -37,6 +37,11 @@ spec:
|
|||||||
env:
|
env:
|
||||||
- name: ADDRESS
|
- name: ADDRESS
|
||||||
value: /csi/csi.sock
|
value: /csi/csi.sock
|
||||||
|
securityContext:
|
||||||
|
# This is necessary only for systems with SELinux, where
|
||||||
|
# non-privileged sidecar containers cannot access unix domain socket
|
||||||
|
# created by privileged CSI driver container.
|
||||||
|
privileged: true
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /csi
|
- mountPath: /csi
|
||||||
|
@ -38,6 +38,11 @@ spec:
|
|||||||
env:
|
env:
|
||||||
- name: ADDRESS
|
- name: ADDRESS
|
||||||
value: /csi/csi.sock
|
value: /csi/csi.sock
|
||||||
|
securityContext:
|
||||||
|
# This is necessary only for systems with SELinux, where
|
||||||
|
# non-privileged sidecar containers cannot access unix domain socket
|
||||||
|
# created by privileged CSI driver container.
|
||||||
|
privileged: true
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: socket-dir
|
- name: socket-dir
|
||||||
|
Loading…
Reference in New Issue
Block a user