From bad89aec109af096be0c26042f12a65e5ad7fbf3 Mon Sep 17 00:00:00 2001 From: cloudonly Date: Sat, 31 Oct 2026 11:37:16 +0800 Subject: [PATCH 1/4] docs: retain NFS controller privileges in the CSI example Signed-off-by: cloudonly --- docs/guides/csi-deployment.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/guides/csi-deployment.md b/docs/guides/csi-deployment.md index c9367ef751..80b4657975 100644 --- a/docs/guides/csi-deployment.md +++ b/docs/guides/csi-deployment.md @@ -185,6 +185,10 @@ data: #### 2. Envoy Sidecar in `csi-nfs-controller` Deployment +The `nfs` container needs privileged mode to mount the NFS share while creating +and deleting volume directories, as in the +[vendored controller manifest](../../hack/third_party/csi-driver-nfs/deploy/csi-nfs-controller.yaml). + ```yaml apiVersion: apps/v1 kind: Deployment @@ -205,9 +209,16 @@ spec: # Upstream CSI NFS driver container listening on local Unix socket - name: nfs image: registry.k8s.io/sig-storage/nfsplugin:v4.13.4 + securityContext: + privileged: true args: - "--nodeid=$(NODE_ID)" - "--endpoint=unix:///csi/csi.sock" + env: + - name: NODE_ID + valueFrom: + fieldRef: + fieldPath: spec.nodeName volumeMounts: - name: socket-dir mountPath: /csi From 5220f93c54534d5b7381af1df34c12b5c3b8ddc3 Mon Sep 17 00:00:00 2001 From: cloudonly Date: Wed, 4 Nov 2026 11:13:51 +0800 Subject: [PATCH 2/4] docs: grant only SYS_ADMIN for NFS controller mounts Signed-off-by: cloudonly --- docs/guides/csi-deployment.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/guides/csi-deployment.md b/docs/guides/csi-deployment.md index 80b4657975..8a7a1a6c2c 100644 --- a/docs/guides/csi-deployment.md +++ b/docs/guides/csi-deployment.md @@ -185,9 +185,10 @@ data: #### 2. Envoy Sidecar in `csi-nfs-controller` Deployment -The `nfs` container needs privileged mode to mount the NFS share while creating -and deleting volume directories, as in the -[vendored controller manifest](../../hack/third_party/csi-driver-nfs/deploy/csi-nfs-controller.yaml). +The controller mounts the NFS share when creating and deleting volume directories. +Add `SYS_ADMIN` to the `nfs` container's default capabilities for these mounts. +Any seccomp, AppArmor, or SELinux policy applied by the cluster must also permit +NFS mounts. Envoy keeps its restricted security context. ```yaml apiVersion: apps/v1 @@ -210,7 +211,8 @@ spec: - name: nfs image: registry.k8s.io/sig-storage/nfsplugin:v4.13.4 securityContext: - privileged: true + capabilities: + add: [SYS_ADMIN] args: - "--nodeid=$(NODE_ID)" - "--endpoint=unix:///csi/csi.sock" From 80efad55b5057ae7db6f3e463c0e999bf8eb279b Mon Sep 17 00:00:00 2001 From: cloudonly Date: Wed, 4 Nov 2026 13:32:25 +0800 Subject: [PATCH 3/4] docs: restore upstream NFS controller privileges SYS_ADMIN alone leaves mounts blocked by default AppArmor profiles. Keep the upstream privileged example and qualify the permission guidance. Signed-off-by: cloudonly --- docs/guides/csi-deployment.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/guides/csi-deployment.md b/docs/guides/csi-deployment.md index 8a7a1a6c2c..332a485dd0 100644 --- a/docs/guides/csi-deployment.md +++ b/docs/guides/csi-deployment.md @@ -186,9 +186,10 @@ data: #### 2. Envoy Sidecar in `csi-nfs-controller` Deployment The controller mounts the NFS share when creating and deleting volume directories. -Add `SYS_ADMIN` to the `nfs` container's default capabilities for these mounts. -Any seccomp, AppArmor, or SELinux policy applied by the cluster must also permit -NFS mounts. Envoy keeps its restricted security context. +This example uses privileged mode for the `nfs` container, following the +[vendored controller manifest](../../hack/third_party/csi-driver-nfs/deploy/csi-nfs-controller.yaml). +Adding `SYS_ADMIN` alone does not bypass security profiles that deny mounts. +Envoy keeps its restricted security context. ```yaml apiVersion: apps/v1 @@ -211,8 +212,7 @@ spec: - name: nfs image: registry.k8s.io/sig-storage/nfsplugin:v4.13.4 securityContext: - capabilities: - add: [SYS_ADMIN] + privileged: true args: - "--nodeid=$(NODE_ID)" - "--endpoint=unix:///csi/csi.sock" From 901068b999c4f25ad53406bdf6283fc0c66185cc Mon Sep 17 00:00:00 2001 From: cloudonly Date: Tue, 10 Nov 2026 14:14:47 +0800 Subject: [PATCH 4/4] docs: explain the CSI Envoy sidecar setup Signed-off-by: cloudonly --- docs/guides/csi-deployment.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/guides/csi-deployment.md b/docs/guides/csi-deployment.md index 332a485dd0..ddf092c29c 100644 --- a/docs/guides/csi-deployment.md +++ b/docs/guides/csi-deployment.md @@ -185,11 +185,14 @@ data: #### 2. Envoy Sidecar in `csi-nfs-controller` Deployment -The controller mounts the NFS share when creating and deleting volume directories. -This example uses privileged mode for the `nfs` container, following the -[vendored controller manifest](../../hack/third_party/csi-driver-nfs/deploy/csi-nfs-controller.yaml). -Adding `SYS_ADMIN` alone does not bypass security profiles that deny mounts. -Envoy keeps its restricted security context. +The `envoy-proxy` sidecar shares `socket-dir` (`/csi`) with the CSI driver +container and mounts the Envoy configuration (`envoy-config`), the Service DNS +serving certificate (`servicedns-certs`), and the Pod Identity trust bundle +(`podidentity-ca`). Even when the CSI driver container itself requires elevated +privileges (such as [the upstream `csi-nfs-controller` manifest](../../hack/third_party/csi-driver-nfs/deploy/csi-nfs-controller.yaml)), +the Envoy sidecar runs with a restricted `securityContext` +(`allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true`, and all +capabilities dropped). ```yaml apiVersion: apps/v1