Remove security context with "privileged: true" setting on Windows node #201

lizhuqi · 2021-01-14T21:55:12Z

Remove security context with "privileged: true" setting

DaemonSet in Windows node is not allowed to perform privileged actions so privileged field in security context shouldn't be true.

What type of PR is this?
/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Requirements:

uses conventional commit messages
fix: Bug Fixes 🐞
includes documentation
adds unit tests
tested upgrade from previous version

Special notes for your reviewer:

Release note:

Remove security context with "privileged: true" setting on Windows node

Remove setting privileged to be true security context. DaemonSet in Windows node is not allowed to perform privileged actions so privileged field in security context shouldn't be true.

k8s-ci-robot · 2021-01-14T21:55:20Z

Welcome @lizhuqi!

It looks like this is your first PR to kubernetes-csi/csi-driver-smb 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-csi/csi-driver-smb has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2021-01-14T21:55:20Z

Hi @lizhuqi. Thanks for your PR.

I'm waiting for a kubernetes-csi member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

coveralls · 2021-01-14T22:09:01Z

Pull Request Test Coverage Report for Build 489311129

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 86.086%

Totals
Change from base Build 466058296:	0.0%
Covered Lines:	662
Relevant Lines:	769

💛 - Coveralls

andyzhangx · 2021-01-15T03:55:28Z

/ok-to-test

andyzhangx · 2021-01-15T03:57:20Z

would you also remove the securityContext here? thanks.

csi-driver-smb/deploy/csi-smb-node-windows.yaml

Lines 98 to 99 in a9a2e47

    
           securityContext: 
        
             privileged: true

lizhuqi · 2021-01-15T19:12:04Z

My change will merge back to master so those two lines will be removed after the PR is merged I think. Do you mean make the changes to the other versions?

andyzhangx · 2021-01-16T00:46:56Z

My change will merge back to master so those two lines will be removed after the PR is merged I think. Do you mean make the changes to the other versions?

sorry I meant this:

csi-driver-smb/charts/latest/csi-driver-smb/templates/csi-smb-node-windows.yaml

Lines 100 to 101 in a9a2e47

    
           securityContext: 
        
             privileged: true

…nto patch-1

andyzhangx · 2021-01-16T01:23:10Z

could you squash all commits by git rebase -i HEAD~4? thanks.

andyzhangx · 2021-01-16T01:27:24Z

could you squash all commits by git rebase -i HEAD~4? thanks.

not necessary now, I have set as Squash and merge mode.

andyzhangx

/lgtm
/approve

k8s-ci-robot · 2021-01-16T01:27:46Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyzhangx, lizhuqi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [andyzhangx]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lizhuqi · 2021-01-16T01:35:30Z

Thanks Andy for the approval!

aa61bfd0 Merge pull request kubernetes-csi#218 from xing-yang/update_csi_driver 7563d196 Update CSI_PROW_DRIVER_VERSION to v1.11.0 a2171bef Merge pull request kubernetes-csi#216 from msau42/process cb987826 Merge pull request kubernetes-csi#217 from msau42/owners a11216e4 add new reviewers and remove inactive reviewers dd986754 Add step for checking builds b66c0824 Merge pull request kubernetes-csi#214 from pohly/junit-fixes b9b6763b filter-junit.go: fix loss of testcases when parsing Ginkgo v2 JUnit d4277839 filter-junit.go: preserve system error log 38e11468 prow.sh: publish individual JUnit files as separate artifacts 78c0fb71 Merge pull request kubernetes-csi#208 from jsafrane/skip-selinux 36e433e2 Skip SELinux tests in CI by default 348d4a92 Merge pull request kubernetes-csi#207 from RaunakShah/reviewers 1efc2724 Merge pull request kubernetes-csi#206 from RaunakShah/update-prow 7d410d88 Changes to csi prow to run e2e tests in sidecars cfa5a75c Merge pull request kubernetes-csi#203 from humblec/test-vendor 4edd1d8a Add RaunakShah to CSI reviewers group 7ccc9594 release tools update to 1.19 d24254f6 Merge pull request kubernetes-csi#202 from xing-yang/kind_0.14.0 0faa3fc7 Update to Kind v0.14.0 images ef4e1b2b Merge pull request kubernetes-csi#201 from xing-yang/add_1.24_image 4ddce251 Add 1.24 Kind image 7fe51491 Merge pull request kubernetes-csi#200 from pohly/bump-kubernetes-version 70915a8e prow.sh: update snapshotter version 31a3f38b Merge pull request kubernetes-csi#199 from pohly/bump-kubernetes-version 7577454a prow.sh: bump Kubernetes to v1.22.0 d29a2e75 Merge pull request kubernetes-csi#198 from pohly/csi-test-5.0.0 41cb70d3 prow.sh: sanity testing with csi-test v5.0.0 c85a63fb Merge pull request kubernetes-csi#197 from pohly/fix-alpha-testing b86d8e94 support Kubernetes 1.25 + Ginkgo v2 ab0b0a3d Merge pull request kubernetes-csi#192 from andyzhangx/patch-1 7bbab24e Merge pull request kubernetes-csi#196 from humblec/non-alpha e51ff2cc introduce control variable for non alpha feature gate configuration ca19ef52 Merge pull request kubernetes-csi#195 from pohly/fix-alpha-testing 3948331e fix testing with latest Kubernetes e4dab7ff Merge pull request kubernetes-csi#194 from yselkowitz/registry-k8s-io 84a4d5a1 Move from k8s.gcr.io to registry.k8s.io 9a0260c5 fix boilerplate header 37d1104 Merge pull request kubernetes-csi#191 from pohly/go-1.18 db917f5 update to Go 1.18 git-subtree-dir: release-tools git-subtree-split: aa61bfd0c1a80460aba7cb0feddc8cdee03622a4

aa61bfd0 Merge pull request #218 from xing-yang/update_csi_driver 7563d196 Update CSI_PROW_DRIVER_VERSION to v1.11.0 a2171bef Merge pull request #216 from msau42/process cb987826 Merge pull request #217 from msau42/owners a11216e4 add new reviewers and remove inactive reviewers dd986754 Add step for checking builds b66c0824 Merge pull request #214 from pohly/junit-fixes b9b6763b filter-junit.go: fix loss of testcases when parsing Ginkgo v2 JUnit d4277839 filter-junit.go: preserve system error log 38e11468 prow.sh: publish individual JUnit files as separate artifacts 78c0fb71 Merge pull request #208 from jsafrane/skip-selinux 36e433e2 Skip SELinux tests in CI by default 348d4a92 Merge pull request #207 from RaunakShah/reviewers 1efc2724 Merge pull request #206 from RaunakShah/update-prow 7d410d88 Changes to csi prow to run e2e tests in sidecars cfa5a75c Merge pull request #203 from humblec/test-vendor 4edd1d8a Add RaunakShah to CSI reviewers group 7ccc9594 release tools update to 1.19 d24254f6 Merge pull request #202 from xing-yang/kind_0.14.0 0faa3fc7 Update to Kind v0.14.0 images ef4e1b2b Merge pull request #201 from xing-yang/add_1.24_image 4ddce251 Add 1.24 Kind image 7fe51491 Merge pull request #200 from pohly/bump-kubernetes-version 70915a8e prow.sh: update snapshotter version 31a3f38b Merge pull request #199 from pohly/bump-kubernetes-version 7577454a prow.sh: bump Kubernetes to v1.22.0 d29a2e75 Merge pull request #198 from pohly/csi-test-5.0.0 41cb70d3 prow.sh: sanity testing with csi-test v5.0.0 c85a63fb Merge pull request #197 from pohly/fix-alpha-testing b86d8e94 support Kubernetes 1.25 + Ginkgo v2 ab0b0a3d Merge pull request #192 from andyzhangx/patch-1 7bbab24e Merge pull request #196 from humblec/non-alpha e51ff2cc introduce control variable for non alpha feature gate configuration ca19ef52 Merge pull request #195 from pohly/fix-alpha-testing 3948331e fix testing with latest Kubernetes e4dab7ff Merge pull request #194 from yselkowitz/registry-k8s-io 84a4d5a1 Move from k8s.gcr.io to registry.k8s.io 9a0260c5 fix boilerplate header 37d1104 Merge pull request #191 from pohly/go-1.18 db917f5 update to Go 1.18 git-subtree-dir: release-tools git-subtree-split: aa61bfd0c1a80460aba7cb0feddc8cdee03622a4

Update csi-smb-node-windows.yaml

0567e96

Remove setting privileged to be true security context. DaemonSet in Windows node is not allowed to perform privileged actions so privileged field in security context shouldn't be true.

k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. release-note-none Denotes a PR that doesn't merit a release note. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 14, 2021

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jan 14, 2021

k8s-ci-robot requested review from andyzhangx and ZeroMagic January 14, 2021 21:55

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jan 14, 2021

Remove SecurityContext with true value privileged field

2723461

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 15, 2021

andyzhangx changed the title ~~Remove security context with "privileged: true" setting~~ Remove security context with "privileged: true" setting on Windows node Jan 15, 2021

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Jan 15, 2021

lizhuqi added 2 commits January 15, 2021 17:07

Remove SecurityContext with true value privileged field

8f83b8f

Merge branch 'patch-1' of https://github.com/lizhuqi/csi-driver-smb i…

1a5af19

…nto patch-1

andyzhangx approved these changes Jan 16, 2021

View reviewed changes

k8s-ci-robot assigned andyzhangx Jan 16, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 16, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 16, 2021

andyzhangx closed this Jan 16, 2021

andyzhangx reopened this Jan 16, 2021

k8s-ci-robot merged commit 155dc8d into kubernetes-csi:master Jan 16, 2021

lizhuqi deleted the patch-1 branch May 26, 2021 18:32

lizhuqi mentioned this pull request Jun 4, 2021

REQUEST: New membership for lizhuqi kubernetes/org#2763

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove security context with "privileged: true" setting on Windows node #201

Remove security context with "privileged: true" setting on Windows node #201

lizhuqi commented Jan 14, 2021 •

edited by andyzhangx

Loading

k8s-ci-robot commented Jan 14, 2021

k8s-ci-robot commented Jan 14, 2021

coveralls commented Jan 14, 2021 •

edited

Loading

andyzhangx commented Jan 15, 2021

andyzhangx commented Jan 15, 2021

lizhuqi commented Jan 15, 2021

andyzhangx commented Jan 16, 2021

andyzhangx commented Jan 16, 2021

andyzhangx commented Jan 16, 2021

andyzhangx left a comment

k8s-ci-robot commented Jan 16, 2021

lizhuqi commented Jan 16, 2021

Remove security context with "privileged: true" setting on Windows node #201

Remove security context with "privileged: true" setting on Windows node #201

Conversation

lizhuqi commented Jan 14, 2021 • edited by andyzhangx Loading

k8s-ci-robot commented Jan 14, 2021

k8s-ci-robot commented Jan 14, 2021

coveralls commented Jan 14, 2021 • edited Loading

Pull Request Test Coverage Report for Build 489311129

💛 - Coveralls

andyzhangx commented Jan 15, 2021

andyzhangx commented Jan 15, 2021

lizhuqi commented Jan 15, 2021

andyzhangx commented Jan 16, 2021

andyzhangx commented Jan 16, 2021

andyzhangx commented Jan 16, 2021

andyzhangx left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jan 16, 2021

lizhuqi commented Jan 16, 2021

lizhuqi commented Jan 14, 2021 •

edited by andyzhangx

Loading

coveralls commented Jan 14, 2021 •

edited

Loading