deploy: allowPrivilegeEscalation: true in containerSecurityContext

When running the kubernetes cluster with one single privileged PodSecurityPolicy which is allowing everything the nodeplugin daemonset can fail to start. To be precise the problem is the defaultAllowPrivilegeEscalation: false configuration in the PSP. Containers of the nodeplugin daemonset won't start when they have privileged: true but no allowPrivilegeEscalation in their container securityContext. Kubernetes will not schedule if this mismatch exists cannot set allowPrivilegeEscalation to false and privileged to true: Signed-off-by: Silvan Loser <[email protected]> Signed-off-by: Silvan Loser <[email protected]>
ceph · Apr 22, 2022 · f2e0fa2 · f2e0fa2
1 parent 06c4477
commit f2e0fa2
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/deploy/cephfs/kubernetes/csi-cephfsplugin.yaml b/deploy/cephfs/kubernetes/csi-cephfsplugin.yaml
@@ -26,6 +26,7 @@ spec:
           # created by privileged CSI driver container.
           securityContext:
             privileged: true
+            allowPrivilegeEscalation: true
           image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.4.0
           args:
             - "--v=5"
@@ -106,6 +107,7 @@ spec:
         - name: liveness-prometheus
           securityContext:
             privileged: true
+            allowPrivilegeEscalation: true
           image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--type=liveness"

diff --git a/deploy/rbd/kubernetes/csi-rbdplugin.yaml b/deploy/rbd/kubernetes/csi-rbdplugin.yaml
@@ -28,6 +28,7 @@ spec:
           # created by privileged CSI driver container.
           securityContext:
             privileged: true
+            allowPrivilegeEscalation: true
           image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.4.0
           args:
             - "--v=5"
@@ -124,6 +125,7 @@ spec:
         - name: liveness-prometheus
           securityContext:
             privileged: true
+            allowPrivilegeEscalation: true
           image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--type=liveness"