Skip to content

Commit 298af63

Browse files
committed
update security context for CSI Node DS
1 parent 6fd2fcf commit 298af63

File tree

1 file changed

+4
-4
lines changed
  • charts/spdk-csi/latest/spdk-csi/templates

1 file changed

+4
-4
lines changed

charts/spdk-csi/latest/spdk-csi/templates/node.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,10 @@ spec:
7373
mountPath: /registration
7474
- name: csi-node
7575
securityContext:
76-
privileged: true
77-
capabilities:
78-
add: ["SYS_ADMIN", "SYS_MODULE"]
79-
allowPrivilegeEscalation: true
76+
privileged: true # Needs to run as root user to access kubelet plugins folder and to load kernel modules
77+
runAsUser: 0
78+
runAsGroup: 0
79+
readOnlyRootFilesystem: true
8080
image: "{{ .Values.image.csi.repository }}:{{ .Values.image.csi.tag }}"
8181
imagePullPolicy: {{ .Values.image.csi.pullPolicy }}
8282
args:

0 commit comments

Comments
 (0)