Skip to content

Commit bf33e54

Browse files
prankulmahajanprankulmahajan
authored
Allow livenessprobe to run as root (#83)
Signed-off-by: Prankul <[email protected]>
1 parent d500205 commit bf33e54

File tree

8 files changed

+458
-22
lines changed

8 files changed

+458
-22
lines changed

‎deploy/kubernetes/driver/kubernetes/manifests/controller-server.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ spec:
2525
securityContext:
2626
runAsNonRoot: true
2727
runAsUser: 2121
28+
runAsGroup: 2121
2829
containers:
2930
- name: csi-provisioner
3031
image: MUSTPATCHWITHKUSTOMIZE
@@ -187,6 +188,13 @@ spec:
187188
configMapKeyRef:
188189
name: ibm-vpc-file-csi-configmap
189190
key: SIDECAR_ENDPOINT
191+
resources:
192+
limits:
193+
cpu: 12m
194+
memory: 20Mi
195+
requests:
196+
cpu: 3m
197+
memory: 5Mi
190198
volumeMounts:
191199
- mountPath: /sidecardir
192200
name: socket-dir

‎deploy/kubernetes/driver/kubernetes/manifests/node-server.yaml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ spec:
3131
securityContext:
3232
runAsNonRoot: false
3333
runAsUser: 0
34+
runAsGroup: 0
3435
privileged: false
3536
args:
3637
- "--v=5"
@@ -64,6 +65,7 @@ spec:
6465
securityContext:
6566
runAsNonRoot: false
6667
runAsUser: 0
68+
runAsGroup: 0
6769
privileged: true
6870
image: MUSTPATCHWITHKUSTOMIZE
6971
imagePullPolicy: Always
@@ -89,6 +91,10 @@ spec:
8991
valueFrom:
9092
fieldRef:
9193
fieldPath: spec.nodeName
94+
- name: IS_NODE_SERVER
95+
value: "true"
96+
- name: SIDECAR_GROUP_ID
97+
value: "2121"
9298
resources:
9399
limits:
94100
cpu: 200m
@@ -135,9 +141,13 @@ spec:
135141
- name: liveness-probe
136142
image: MUSTPATCHWITHKUSTOMIZE
137143
securityContext:
138-
runAsNonRoot: false
139-
runAsUser: 0
144+
runAsNonRoot: true
145+
runAsUser: 2121
146+
runAsGroup: 2121
140147
privileged: false
148+
seLinuxOptions: # seLinux label is set as a precaution for accessing csi socket
149+
type: spc_t
150+
level: s0
141151
args:
142152
- "--csi-address=$(CSI_ADDRESS)"
143153
env:
@@ -158,6 +168,11 @@ spec:
158168
mountPath: /csi
159169
- name: storage-secret-sidecar
160170
image: MUSTPATCHWITHKUSTOMIZE
171+
securityContext:
172+
runAsNonRoot: true
173+
runAsUser: 2121
174+
runAsGroup: 2121
175+
privileged: false
161176
imagePullPolicy: Always
162177
args:
163178
- "--endpoint=$(SIDECAR_ENDPOINT)"

‎go.mod‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ require (
1414
github.com/prometheus/client_golang v1.16.0
1515
github.com/stretchr/testify v1.8.2
1616
go.uber.org/zap v1.20.0
17-
golang.org/x/net v0.19.0
18-
golang.org/x/sys v0.15.0
17+
golang.org/x/net v0.20.0
18+
golang.org/x/sys v0.16.0
1919
google.golang.org/grpc v1.56.3
2020
k8s.io/api v0.28.6
2121
k8s.io/apimachinery v0.28.6
@@ -55,7 +55,7 @@ require (
5555
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
5656
github.com/golang/protobuf v1.5.4 // indirect
5757
github.com/google/gnostic-models v0.6.8 // indirect
58-
github.com/google/go-cmp v0.5.9 // indirect
58+
github.com/google/go-cmp v0.6.0 // indirect
5959
github.com/google/gofuzz v1.2.0 // indirect
6060
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
6161
github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
@@ -65,6 +65,7 @@ require (
6565
github.com/leodido/go-urn v1.2.1 // indirect
6666
github.com/mailru/easyjson v0.7.7 // indirect
6767
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
68+
github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1 // indirect
6869
github.com/mitchellh/mapstructure v1.4.1 // indirect
6970
github.com/moby/sys/mountinfo v0.6.2 // indirect
7071
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -73,7 +74,7 @@ require (
7374
github.com/nxadm/tail v1.4.11 // indirect
7475
github.com/oklog/ulid v1.3.1 // indirect
7576
github.com/onsi/ginkgo v1.16.5 // indirect
76-
github.com/onsi/gomega v1.27.6 // indirect
77+
github.com/onsi/gomega v1.30.0 // indirect
7778
github.com/pkg/errors v0.9.1 // indirect
7879
github.com/pmezard/go-difflib v1.0.0 // indirect
7980
github.com/prometheus/client_model v0.4.0 // indirect
@@ -83,11 +84,13 @@ require (
8384
go.mongodb.org/mongo-driver v1.7.5 // indirect
8485
go.uber.org/atomic v1.11.0 // indirect
8586
go.uber.org/multierr v1.11.0 // indirect
86-
golang.org/x/crypto v0.16.0 // indirect
87+
golang.org/x/crypto v0.18.0 // indirect
88+
golang.org/x/mod v0.14.0 // indirect
8789
golang.org/x/oauth2 v0.8.0 // indirect
88-
golang.org/x/term v0.15.0 // indirect
90+
golang.org/x/term v0.16.0 // indirect
8991
golang.org/x/text v0.14.0 // indirect
9092
golang.org/x/time v0.3.0 // indirect
93+
golang.org/x/tools v0.17.0 // indirect
9194
google.golang.org/appengine v1.6.7 // indirect
9295
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect
9396
google.golang.org/protobuf v1.33.0 // indirect

‎go.sum‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,8 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
131131
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
132132
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
133133
github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
134-
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
135-
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
134+
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
135+
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
136136
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
137137
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
138138
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -205,14 +205,14 @@ github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vv
205205
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
206206
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
207207
github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
208-
github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE=
208+
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
209209
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
210210
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
211211
github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48=
212212
github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
213213
github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
214-
github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
215-
github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
214+
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
215+
github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
216216
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
217217
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
218218
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -275,8 +275,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
275275
golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
276276
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
277277
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
278-
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
279-
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
278+
golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
279+
golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
280280
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
281281
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
282282
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -303,8 +303,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
303303
golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
304304
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
305305
golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
306-
golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
307-
golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
306+
golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
307+
golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
308308
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
309309
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
310310
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
@@ -338,12 +338,12 @@ golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBc
338338
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
339339
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
340340
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
341-
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
342-
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
341+
golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
342+
golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
343343
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
344344
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
345-
golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
346-
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
345+
golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
346+
golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
347347
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
348348
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
349349
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -366,7 +366,8 @@ golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4f
366366
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
367367
golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
368368
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
369-
golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
369+
golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
370+
golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
370371
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
371372
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
372373
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎pkg/ibmcsidriver/fileOps.go‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
/**
2+
*
3+
* Copyright 2024- IBM Inc. All rights reserved
4+
* SPDX-License-Identifier: Apache2.0
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
// Package ibmcsidriver ...
20+
package ibmcsidriver
21+
22+
//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
23+
24+
import (
25+
"os"
26+
"strconv"
27+
28+
"go.uber.org/zap"
29+
)
30+
31+
const (
32+
filePermission = 0660
33+
)
34+
35+
//counterfeiter:generate . socketPermission
36+
37+
// socketPermission represents file system operations
38+
type socketPermission interface {
39+
Chown(name string, uid, gid int) error
40+
Chmod(name string, mode os.FileMode) error
41+
}
42+
43+
// realSocketPermission implements socketPermission
44+
type opsSocketPermission struct{}
45+
46+
func (f *opsSocketPermission) Chown(name string, uid, gid int) error {
47+
return os.Chown(name, uid, gid)
48+
}
49+
50+
func (f *opsSocketPermission) Chmod(name string, mode os.FileMode) error {
51+
return os.Chmod(name, mode)
52+
}
53+
54+
// setupSidecar updates owner/group and permission of the file given(addr)
55+
func setupSidecar(addr string, ops socketPermission, logger *zap.Logger) error {
56+
groupSt := os.Getenv("SIDECAR_GROUP_ID")
57+
58+
logger.Info("Setting owner and permissions of csi socket file. SIDECAR_GROUP_ID env must match the 'livenessprobe' sidecar container groupID for csi socket connection.")
59+
60+
// If env is not set, set default to 0
61+
if groupSt == "" {
62+
logger.Warn("Unable to fetch SIDECAR_GROUP_ID environment variable. Sidecar container(s) might fail...")
63+
groupSt = "0"
64+
}
65+
66+
group, err := strconv.Atoi(groupSt)
67+
if err != nil {
68+
return err
69+
}
70+
71+
// Change group of csi socket to non-root user for enabling the csi sidecar
72+
if err := ops.Chown(addr, -1, group); err != nil {
73+
return err
74+
}
75+
76+
// Modify permissions of csi socket
77+
// Only the users and the group owners will have read/write access to csi socket
78+
if err := ops.Chmod(addr, filePermission); err != nil {
79+
return err
80+
}
81+
82+
logger.Info("Successfully set owner and permissions of csi socket file.")
83+
84+
return nil
85+
}

0 commit comments

Comments
 (0)