Use kustomize for csi driver

Signed-off-by: Jirka Kremser <[email protected]>

.gitignore

@@ -1,3 +1,3 @@
 # binary
-/bin/kustomize
+/bin/*
 

Makefile.custom.mk

@@ -4,9 +4,11 @@ OS ?= $(shell go env GOOS 2>/dev/null || echo linux)
 ARCH ?= $(shell go env GOARCH 2>/dev/null || echo amd64)
 KUSTOMIZE := ./bin/kustomize
 KUSTOMIZE_VERSION ?= v4.5.7
+YQ = ./bin/yq
+YQ_VERSION := 4.31.2
 
 .PHONY: all
-all: update-cpi-chart update-csi-chart update-kubevip-chart update-kubevip-cloud-provider-chart
+all: update-cpi-chart update-csi-chart apply-custom-patches-for-csi update-kubevip-chart update-kubevip-cloud-provider-chart
 	@$(call say,Sync has been done ✓)
 
 .PHONY: update-cpi-chart
@@ -15,11 +17,16 @@ update-cpi-chart:
 	./hack/update-cpi-chart.sh
 	./hack/common-labels-injector.sh cloud-provider-for-vsphere
 
+.PHONY: apply-custom-patches-for-csi
+apply-custom-patches-for-csi: $(YQ) ## apply giantswarm specific patches that are not possible via kustomize
+	@$(call say,Custom yq magic for CSI)
+	./hack/custom-patches.sh
+	./hack/common-labels-injector.sh vsphere-csi-driver
+
 .PHONY: update-csi-chart
 update-csi-chart: $(KUSTOMIZE)
 	@$(call say,CSI helm chart)
 	./hack/update-csi-chart.sh $(KUSTOMIZE)
-	./hack/common-labels-injector.sh vsphere-csi-driver
 
 .PHONY: update-kubevip-chart
 update-kubevip-chart:
@@ -40,6 +47,13 @@ $(KUSTOMIZE): ## Download kustomize locally if necessary.
 	chmod +x $@
 	@echo "kustomize downloaded"
 
+$(YQ): ## Download yq locally if necessary.
+	@$(call say,Download yq)
+	curl -sfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(OS)_$(ARCH) > $@
+	chmod +x $@
+	@echo "yq downloaded"
+
+
 ifndef NO_COLOR
 YELLOW=\033[0;33m
 # no color

config/cloud-provider-for-vsphere/overwrites/templates/pss-exceptions.yaml

@@ -31,4 +31,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - cloud-provider-for-vsphere*
-{{- end }}
+{{- end }}

config/kube-vip-cloud-provider/overwrites/templates/pss-exceptions.yaml

@@ -31,4 +31,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - kube-vip-cloud-provider*
-{{- end }}
+{{- end }}

config/kube-vip/overwrites/templates/pss-exceptions.yaml

@@ -62,4 +62,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - kube-vip
-{{- end }}
+{{- end }}

config/vsphere-csi-driver/overwrites/templates/pss-exceptions.yaml

@@ -28,24 +28,24 @@ spec:
     ruleNames:
     - restricted-volumes
     - autogen-restricted-volumes
-  - policyName: require-run-as-nonroot
-    ruleNames:
-    - run-as-non-root
-    - autogen-run-as-non-root
+  # - policyName: require-run-as-nonroot
+  #   ruleNames:
+  #   - run-as-non-root
+  #   - autogen-run-as-non-root
   - policyName: restrict-seccomp-strict
     ruleNames:
     - check-seccomp-strict
     - autogen-check-seccomp-strict
-  - policyName: disallow-capabilities
-    ruleNames:
-    - adding-capabilities
-    - autogen-adding-capabilities
-  - policyName: disallow-capabilities-strict
-    ruleNames:
-    - adding-capabilities-strict
-    - autogen-adding-capabilities-strict
-    - require-drop-all
-    - autogen-require-drop-all
+  # - policyName: disallow-capabilities
+  #   ruleNames:
+  #   - adding-capabilities
+  #   - autogen-adding-capabilities
+  # - policyName: disallow-capabilities-strict
+  #   ruleNames:
+  #   - adding-capabilities-strict
+  #   - autogen-adding-capabilities-strict
+  #   - require-drop-all
+  #   - autogen-require-drop-all
   - policyName: disallow-privilege-escalation
     ruleNames:
     - privilege-escalation
@@ -62,4 +62,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - vsphere-csi*
-{{- end }}
+{{- end }}

config/vsphere-csi-driver/overwrites/values.yaml

@@ -53,3 +53,9 @@ storageClass:
     isDefault: false
     vcdStorageProfileName: "vSAN Default Storage Policy"
     fileSystem: "ext4"
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault

hack/custom-patches.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+YQ="./bin/yq"
+
+f="helm/cloud-provider-vsphere/charts/vsphere-csi-driver/templates/apps_v1_deployment_vsphere-csi-controller.yaml"
+${YQ} e '.spec.template.spec.securityContext.remove-this-key="'"
+{{- with .Values.podSecurityContext }}
+  {{- . | toYaml | nindent 8 }}
+{{- end }}
+"'" | .spec.template.spec.containers[].securityContext.remove-this-key="'"
+{{- with .Values.containerSecurityContext }}
+  {{- . | toYaml | nindent 12 }}
+{{- end }}
+"'"' ${f} > ${f}.tmp
+cat ${f}.tmp | grep -v 'remove-this-key' > ${f}
+rm -rf ${f}.tmp

helm/cloud-provider-vsphere/charts/cloud-provider-for-vsphere/templates/pss-exceptions.yaml

@@ -31,4 +31,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - cloud-provider-for-vsphere*
-{{- end }}
+{{- end }}

helm/cloud-provider-vsphere/charts/kube-vip-cloud-provider/templates/pss-exceptions.yaml

@@ -31,4 +31,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - kube-vip-cloud-provider*
-{{- end }}
+{{- end }}

helm/cloud-provider-vsphere/charts/kube-vip/templates/pss-exceptions.yaml

@@ -62,4 +62,4 @@ spec:
         - {{ .Release.Namespace }}
         names:
         - kube-vip
-{{- end }}
+{{- end }}