From f772c78cdaac9b521d303add0b209f7adc8df5a4 Mon Sep 17 00:00:00 2001 From: 1602077 <62025739+1602077@users.noreply.github.com> Date: Thu, 6 Jun 2024 10:23:10 +0200 Subject: [PATCH] deploy: configurable podSecurityContexts in ceph-csi-rbd Signed-off-by: 1602077 <62025739+1602077@users.noreply.github.com> --- PendingReleaseNotes.md | 1 + charts/ceph-csi-rbd/README.md | 2 ++ charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml | 1 + charts/ceph-csi-rbd/templates/provisioner-deployment.yaml | 1 + charts/ceph-csi-rbd/values.yaml | 4 ++++ 5 files changed, 9 insertions(+) diff --git a/PendingReleaseNotes.md b/PendingReleaseNotes.md index ff18a00f5c6..b4fabb66f21 100644 --- a/PendingReleaseNotes.md +++ b/PendingReleaseNotes.md @@ -5,5 +5,6 @@ ## Features - deploy: podSecurityContexts can be configured for ceph-csi-cephfs chart in [PR](https://github.com/ceph/ceph-csi/pull/4664). +- deploy: podSecurityContexts can be configured for ceph-csi-rbd chart in [PR](https://github.com/ceph/ceph-csi/pull/4668) ## NOTE diff --git a/charts/ceph-csi-rbd/README.md b/charts/ceph-csi-rbd/README.md index a5850f04612..f0f45df826f 100644 --- a/charts/ceph-csi-rbd/README.md +++ b/charts/ceph-csi-rbd/README.md @@ -131,6 +131,7 @@ charts and their default values. | `nodeplugin.plugin.image.repository` | Nodeplugin image repository URL | `quay.io/cephcsi/cephcsi` | | `nodeplugin.plugin.image.tag` | Image tag | `canary` | | `nodeplugin.plugin.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `nodeplugin.podSecurityContext` | Specifies pod-level security context. | `{}` | | `nodeplugin.nodeSelector` | Kubernetes `nodeSelector` to add to the Daemonset | `{}` | | `nodeplugin.tolerations` | List of Kubernetes `tolerations` to add to the Daemonset | `{}` | | `nodeplugin.podSecurityPolicy.enabled` | If true, create & use [Pod Security Policy resources](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). | `false` | @@ -154,6 +155,7 @@ charts and their default values. | `provisioner.provisioner.image.tag` | Specifies image tag | `v4.0.1` | | `provisioner.provisioner.image.pullPolicy` | Specifies pull policy | `IfNotPresent` | | `provisioner.provisioner.image.extraArgs` | Specifies extra arguments for the provisioner sidecar | `[]` | +| `provisioner.podSecurityContext` | Specifies pod-level security context. | `{}` | | `provisioner.snapshotter.args.enableVolumeGroupSnapshots` | enables the creation of volume group snapshots | `false` | | `provisioner.attacher.image.repository` | Specifies the csi-attacher image repository URL | `registry.k8s.io/sig-storage/csi-attacher` | | `provisioner.attacher.image.tag` | Specifies image tag | `v4.5.` | diff --git a/charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml b/charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml index 925ea6908a6..a511f67aa8c 100644 --- a/charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml +++ b/charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml @@ -28,6 +28,7 @@ spec: heritage: {{ .Release.Service }} {{- with .Values.commonLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }} spec: + securityContext: {{ toYaml .Values.nodeplugin.podSecurityContext | nindent 8 }} serviceAccountName: {{ include "ceph-csi-rbd.serviceAccountName.nodeplugin" . }} hostNetwork: true hostPID: true diff --git a/charts/ceph-csi-rbd/templates/provisioner-deployment.yaml b/charts/ceph-csi-rbd/templates/provisioner-deployment.yaml index 15d122d279d..a922bd2ac64 100644 --- a/charts/ceph-csi-rbd/templates/provisioner-deployment.yaml +++ b/charts/ceph-csi-rbd/templates/provisioner-deployment.yaml @@ -57,6 +57,7 @@ spec: {{ toYaml .Values.provisioner.affinity | indent 8 -}} {{- end -}} {{- end }} + securityContext: {{ toYaml .Values.provisioner.podSecurityContext | nindent 8 }} serviceAccountName: {{ include "ceph-csi-rbd.serviceAccountName.provisioner" . }} hostNetwork: {{ .Values.provisioner.enableHostNetwork }} {{- if .Values.provisioner.priorityClassName }} diff --git a/charts/ceph-csi-rbd/values.yaml b/charts/ceph-csi-rbd/values.yaml index 5af637132b8..40a0a5eeabe 100644 --- a/charts/ceph-csi-rbd/values.yaml +++ b/charts/ceph-csi-rbd/values.yaml @@ -156,6 +156,8 @@ nodeplugin: affinity: {} + podSecurityContext: {} + provisioner: name: provisioner replicaCount: 3 @@ -295,6 +297,8 @@ provisioner: affinity: {} + podSecurityContext: {} + topology: # Specifies whether topology based provisioning support should # be exposed by CSI