Changes in sidecars for non root user pod support

Signed-off-by: Ambika Nair <[email protected]>

Author: ambiknai

controllers/syncer/csi_controller.go

@@ -83,10 +83,10 @@ func (s *csiControllerSyncer) ensurePodSpec() corev1.PodSpec {
 	return corev1.PodSpec{
 		Containers: s.ensureContainersSpec(),
 		Volumes:    s.ensureVolumes(),
-		//		SecurityContext: &corev1.PodSecurityContext{
-		//			FSGroup:   &fsGroup,
-		//			RunAsUser: &fsGroup,
-		//		},
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsNonRoot: util.True(),
+			RunAsUser:    func(uid int64) *int64 { return &uid }(2121),
+		},
 		Affinity:           s.driver.Spec.Controller.Affinity,
 		Tolerations:        s.driver.Spec.Controller.Tolerations,
 		ServiceAccountName: constants.GetResourceName(constants.CSIControllerServiceAccount),

controllers/syncer/csi_node.go

@@ -81,8 +81,12 @@ func (s *csiNodeSyncer) SyncFn() error {
 
 func (s *csiNodeSyncer) ensurePodSpec() corev1.PodSpec {
 	return corev1.PodSpec{
-		Containers:         s.ensureContainersSpec(),
-		Volumes:            s.ensureVolumes(),
+		Containers: s.ensureContainersSpec(),
+		Volumes:    s.ensureVolumes(),
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsNonRoot: func(b bool) *bool { return &b }(true),
+			RunAsUser:    func(uid int64) *int64 { return &uid }(2121),
+		},
 		ServiceAccountName: constants.GetResourceName(constants.CSINodeServiceAccount),
 	}
 }
@@ -123,8 +127,10 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 	})
 
 	nodePlugin.SecurityContext = &corev1.SecurityContext{
+		RunAsNonRoot:             util.False(),
 		Privileged:               util.True(),
 		AllowPrivilegeEscalation: util.True(),
+		RunAsUser:                func(uid int64) *int64 { return &uid }(0),
 	}
 	fillSecurityContextCapabilities(
 		nodePlugin.SecurityContext,
@@ -140,7 +146,9 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 			"--v=5",
 		},
 	)
-	registrar.SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: util.False()}
+	registrar.SecurityContext = &corev1.SecurityContext{RunAsNonRoot: util.False(),
+		RunAsUser:  func(uid int64) *int64 { return &uid }(0),
+		Privileged: util.False()}
 	fillSecurityContextCapabilities(registrar.SecurityContext)
 	registrar.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()
 	registrar.Resources = getSidecarResourceRequests(s.driver, constants.CSINodeDriverRegistrar)