Run all csi-hostpath containers as privileged

On systems with SELinux enabled, non-privileged containers can't access
data of privileged containers. Since the CSI driver socket is exposed
by a privileged container, all sidecars must be privileged too.
This commit is contained in:
Jan Safranek 2019-12-05 13:02:53 +01:00
parent f6337c7624
commit d3c562f7e0
5 changed files with 23 additions and 0 deletions

View File

@ -44,6 +44,11 @@ spec:
args: args:
- --v=5 - --v=5
- --csi-address=/csi/csi.sock - --csi-address=/csi/csi.sock
securityContext:
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
privileged: true
volumeMounts: volumeMounts:
- mountPath: /csi - mountPath: /csi
name: socket-dir name: socket-dir

View File

@ -46,6 +46,9 @@ spec:
- --csi-address=/csi/csi.sock - --csi-address=/csi/csi.sock
- --kubelet-registration-path=/var/lib/kubelet/plugins/csi-hostpath/csi.sock - --kubelet-registration-path=/var/lib/kubelet/plugins/csi-hostpath/csi.sock
securityContext: securityContext:
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
privileged: true privileged: true
env: env:
- name: KUBE_NODE_NAME - name: KUBE_NODE_NAME

View File

@ -46,6 +46,11 @@ spec:
- -v=5 - -v=5
- --csi-address=/csi/csi.sock - --csi-address=/csi/csi.sock
- --connection-timeout=15s - --connection-timeout=15s
securityContext:
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
privileged: true
volumeMounts: volumeMounts:
- mountPath: /csi - mountPath: /csi
name: socket-dir name: socket-dir

View File

@ -37,6 +37,11 @@ spec:
env: env:
- name: ADDRESS - name: ADDRESS
value: /csi/csi.sock value: /csi/csi.sock
securityContext:
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
privileged: true
imagePullPolicy: Always imagePullPolicy: Always
volumeMounts: volumeMounts:
- mountPath: /csi - mountPath: /csi

View File

@ -38,6 +38,11 @@ spec:
env: env:
- name: ADDRESS - name: ADDRESS
value: /csi/csi.sock value: /csi/csi.sock
securityContext:
# This is necessary only for systems with SELinux, where
# non-privileged sidecar containers cannot access unix domain socket
# created by privileged CSI driver container.
privileged: true
imagePullPolicy: Always imagePullPolicy: Always
volumeMounts: volumeMounts:
- name: socket-dir - name: socket-dir