Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

csi-resizer container does not have a securityContext specified #976

Open
wonderland opened this issue Feb 12, 2025 · 1 comment
Open

csi-resizer container does not have a securityContext specified #976

wonderland opened this issue Feb 12, 2025 · 1 comment

Comments

@wonderland
Copy link

Describe the bug

Within the trident-controller deployment, all containers except the csi-resizer have a securityContext specified, which contains a capabilities: drop all. There is no obvious reason why the csi-resizer sidecar should not be able to run with the same securityContext to follow least-privilege best practises. It looks like it might be an oversight that this sidecar does not have it set?

Environment
Provide accurate information about the environment to help us reproduce the issue.

  • Trident version: 24.10

Expected behavior

In a standard deployment of Trident, the csi-resizer container should also include a securityContext that drops unneeded privileges, such as

        securityContext:
          capabilities:
            drop:
            - all
@sjpeeris
Copy link
Collaborator

@wonderland this should get addressed in the upcoming release 25.02

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants