helm: add privileged option for running in ARO (#364)

* Update provider-azure-installer.yaml to support OpenShift / ARO SCC with privileged: true For OpenShift SCC requires privileged: true and also 2 settings below : for the CSI Driver : oc adm policy add-scc-to-user privileged system:serviceaccount:$target_namespace:secrets-store-csi-driver for the Azure KV Provider : oc adm policy add-scc-to-user privileged system:serviceaccount:$target_namespace:csi-secrets-store-provider-azure * Added Fix for ARO securityContext: privileged: true * removed fix for ARO * add conditional for privileged: true Co-authored-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Azure · Feb 2, 2021 · 8d637c4 · 8d637c4
1 parent b23b21f
commit 8d637c4
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/manifest_staging/charts/csi-secrets-store-provider-azure/README.md b/manifest_staging/charts/csi-secrets-store-provider-azure/README.md
@@ -58,6 +58,7 @@ The following table lists the configurable parameters of the csi-secrets-store-p
 | `linux.resources`                                                | Resource limit for provider pods on linux nodes                                                                               | `requests.cpu: 50m`<br>`requests.memory: 100Mi`<br>`limits.cpu: 50m`<br>`limits.memory: 100Mi`   |
 | `linux.priorityClassName`                                        | Indicates the importance of a Pod relative to other Pods.                                                                     | `""`                                                                                             |
 | `linux.updateStrategy`                                           | Configure a custom update strategy for the daemonset on linux nodes                                                           | `RollingUpdate with 1 maxUnavailable`                                                            |
+| `linux.privileged`                                               | Enable privileged mode for Linux **daemonset**                                                                                | `false`                                                                                          |
 | `windows.enabled`                                                | Install azure keyvault provider on windows nodes                                                                              | false                                                                                            |
 | `windows.nodeSelector`                                           | Node Selector for the daemonset on windows nodes                                                                              | `{}`                                                                                             |
 | `windows.tolerations`                                            | Tolerations for the daemonset on windows nodes                                                                                | `{}`                                                                                             |

diff --git a/...t_staging/charts/csi-secrets-store-provider-azure/templates/provider-azure-installer.yaml b/...t_staging/charts/csi-secrets-store-provider-azure/templates/provider-azure-installer.yaml
@@ -51,6 +51,10 @@ spec:
             initialDelaySeconds: 5
           resources:
 {{ toYaml .Values.linux.resources | indent 12 }}
+          {{- if .Values.linux.privileged }}
+          securityContext:
+            privileged: true
+          {{- end }}
           volumeMounts:
             - name: provider-vol
               mountPath: /provider

diff --git a/manifest_staging/charts/csi-secrets-store-provider-azure/values.yaml b/manifest_staging/charts/csi-secrets-store-provider-azure/values.yaml
@@ -30,6 +30,7 @@ linux:
     type: RollingUpdate
     rollingUpdate:
       maxUnavailable: 1
+  privileged: false
 
 windows:
   nodeSelector: {}