Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SELinux options for Bottlerocket #155

Merged
merged 3 commits into from
Feb 27, 2024
Merged

Add SELinux options for Bottlerocket #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d39da24
Add SELinux options for bottlerocket
jjkr Feb 17, 2024
73d7f68
Remove test bucket
jjkr Feb 26, 2024
822ede0
Update kustomization
jjkr Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions charts/aws-mountpoint-s3-csi-driver/templates/node.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,14 @@ spec:
initContainers:
- name: install-mountpoint
image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.image.repository (default (printf "v%s" .Chart.AppVersion) (toString .Values.image.tag)) }}
{{- with .Values.node.seLinuxOptions }}
securityContext:
seLinuxOptions:
user: {{ .user }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion to add default values to these

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are default values set in values.yaml

type: {{ .type }}
role: {{ .role }}
level: {{ .level }}
{{- end }}
imagePullPolicy: IfNotPresent
command:
- "/bin/install-mp"
Expand All @@ -58,6 +66,14 @@ spec:
containers:
- name: s3-plugin
image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.image.repository (default (printf "v%s" .Chart.AppVersion) (toString .Values.image.tag)) }}
{{- with .Values.node.seLinuxOptions }}
securityContext:
seLinuxOptions:
user: {{ .user }}
type: {{ .type }}
role: {{ .role }}
level: {{ .level }}
{{- end }}
imagePullPolicy: IfNotPresent
args:
- --endpoint=$(CSI_ENDPOINT)
Expand Down
7 changes: 5 additions & 2 deletions charts/aws-mountpoint-s3-csi-driver/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,11 @@ node:
kubeletPath: /var/lib/kubelet
mountpointInstallPath: /opt/mountpoint-s3-csi/bin/ # should end with "/"
logLevel: 4
containerSecurityContext:
privileged: true
seLinuxOptions:
user: system_u
type: super_t
role: system_r
level: s0
serviceAccount:
# Specifies whether a service account should be created
create: true
Expand Down
11 changes: 11 additions & 0 deletions deploy/kubernetes/base/node-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,12 @@ spec:
tolerationSeconds: 300
initContainers:
- name: install-mountpoint
securityContext:
seLinuxOptions:
user: system_u
type: super_t
role: system_r
level: s0
image: csi-driver
imagePullPolicy: IfNotPresent
command:
Expand All @@ -42,6 +48,11 @@ spec:
- name: s3-plugin
securityContext:
privileged: false
seLinuxOptions:
user: system_u
type: super_t
role: system_r
level: s0
image: csi-driver
imagePullPolicy: IfNotPresent
args:
Expand Down
Loading