Skip to content

Commit d8c2789

Browse files
umagnusumagnus
committed
fix shield guard
1 parent 882c8b4 commit d8c2789

File tree

9 files changed

+99
-0
lines changed

9 files changed

+99
-0
lines changed

‎charts/latest/blob-csi-driver-v0.0.0.tgz

12 Bytes
Binary file not shown.

‎charts/latest/blob-csi-driver/templates/csi-blob-node.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@ spec:
7878
- "/blobfuse-proxy/init.sh"
7979
securityContext:
8080
privileged: true
81+
capabilities:
82+
drop:
83+
- ALL
8184
env:
8285
- name: DEBIAN_FRONTEND
8386
value: "noninteractive"
@@ -123,6 +126,10 @@ spec:
123126
- --http-endpoint=localhost:{{ .Values.node.livenessProbe.healthPort }}
124127
- --v=2
125128
resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }}
129+
securityContext:
130+
capabilities:
131+
drop:
132+
- ALL
126133
- name: node-driver-registrar
127134
{{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }}
128135
image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}"
@@ -152,6 +159,10 @@ spec:
152159
- name: registration-dir
153160
mountPath: /registration
154161
resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }}
162+
securityContext:
163+
capabilities:
164+
drop:
165+
- ALL
155166
- name: blob
156167
{{- if hasPrefix "/" .Values.image.blob.repository }}
157168
image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
@@ -218,6 +229,9 @@ spec:
218229
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
219230
securityContext:
220231
privileged: true
232+
capabilities:
233+
drop:
234+
- ALL
221235
volumeMounts:
222236
- mountPath: /csi
223237
name: socket-dir
@@ -261,6 +275,9 @@ spec:
261275
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
262276
securityContext:
263277
privileged: true
278+
capabilities:
279+
drop:
280+
- ALL
264281
resources: {{- toYaml .Values.node.resources.aznfswatchdog | nindent 12 }}
265282
volumeMounts:
266283
- mountPath: /opt/microsoft/aznfs/data

‎charts/v1.22.6/blob-csi-driver-v1.22.6.tgz

7 Bytes
Binary file not shown.

‎charts/v1.22.6/blob-csi-driver/templates/csi-blob-node.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ spec:
7979
- "/blobfuse-proxy/init.sh"
8080
securityContext:
8181
privileged: true
82+
capabilities:
83+
drop:
84+
- ALL
8285
env:
8386
- name: DEBIAN_FRONTEND
8487
value: "noninteractive"
@@ -119,6 +122,10 @@ spec:
119122
- --health-port={{ .Values.node.livenessProbe.healthPort }}
120123
- --v=2
121124
resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }}
125+
securityContext:
126+
capabilities:
127+
drop:
128+
- ALL
122129
- name: node-driver-registrar
123130
{{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }}
124131
image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}"
@@ -148,6 +155,10 @@ spec:
148155
- name: registration-dir
149156
mountPath: /registration
150157
resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }}
158+
securityContext:
159+
capabilities:
160+
drop:
161+
- ALL
151162
- name: blob
152163
{{- if hasPrefix "/" .Values.image.blob.repository }}
153164
image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
@@ -216,6 +227,9 @@ spec:
216227
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
217228
securityContext:
218229
privileged: true
230+
capabilities:
231+
drop:
232+
- ALL
219233
volumeMounts:
220234
- mountPath: /csi
221235
name: socket-dir
@@ -259,6 +273,9 @@ spec:
259273
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
260274
securityContext:
261275
privileged: true
276+
capabilities:
277+
drop:
278+
- ALL
262279
resources: {{- toYaml .Values.node.resources.aznfswatchdog | nindent 12 }}
263280
volumeMounts:
264281
- mountPath: /opt/microsoft/aznfs/data

‎charts/v1.24.1/blob-csi-driver-v1.24.1.tgz

11 Bytes
Binary file not shown.

‎charts/v1.24.1/blob-csi-driver/templates/csi-blob-node.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@ spec:
7878
- "/blobfuse-proxy/init.sh"
7979
securityContext:
8080
privileged: true
81+
capabilities:
82+
drop:
83+
- ALL
8184
env:
8285
- name: DEBIAN_FRONTEND
8386
value: "noninteractive"
@@ -123,6 +126,10 @@ spec:
123126
- --health-port={{ .Values.node.livenessProbe.healthPort }}
124127
- --v=2
125128
resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }}
129+
securityContext:
130+
capabilities:
131+
drop:
132+
- ALL
126133
- name: node-driver-registrar
127134
{{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }}
128135
image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}"
@@ -152,6 +159,10 @@ spec:
152159
- name: registration-dir
153160
mountPath: /registration
154161
resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }}
162+
securityContext:
163+
capabilities:
164+
drop:
165+
- ALL
155166
- name: blob
156167
{{- if hasPrefix "/" .Values.image.blob.repository }}
157168
image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
@@ -218,6 +229,9 @@ spec:
218229
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
219230
securityContext:
220231
privileged: true
232+
capabilities:
233+
drop:
234+
- ALL
221235
volumeMounts:
222236
- mountPath: /csi
223237
name: socket-dir
@@ -261,6 +275,9 @@ spec:
261275
imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
262276
securityContext:
263277
privileged: true
278+
capabilities:
279+
drop:
280+
- ALL
264281
resources: {{- toYaml .Values.node.resources.aznfswatchdog | nindent 12 }}
265282
volumeMounts:
266283
- mountPath: /opt/microsoft/aznfs/data

‎deploy/csi-blob-node.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ spec:
4646
- "/blobfuse-proxy/init.sh"
4747
securityContext:
4848
privileged: true
49+
capabilities:
50+
drop:
51+
- ALL
4952
env:
5053
- name: DEBIAN_FRONTEND
5154
value: "noninteractive"
@@ -89,6 +92,10 @@ spec:
8992
requests:
9093
cpu: 10m
9194
memory: 20Mi
95+
securityContext:
96+
capabilities:
97+
drop:
98+
- ALL
9299
- name: node-driver-registrar
93100
image: mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar:v2.10.1
94101
args:
@@ -119,6 +126,10 @@ spec:
119126
requests:
120127
cpu: 10m
121128
memory: 20Mi
129+
securityContext:
130+
capabilities:
131+
drop:
132+
- ALL
122133
- name: blob
123134
image: mcr.microsoft.com/k8s/csi/blob-csi:latest
124135
imagePullPolicy: IfNotPresent
@@ -158,6 +169,9 @@ spec:
158169
fieldPath: spec.nodeName
159170
securityContext:
160171
privileged: true
172+
capabilities:
173+
drop:
174+
- ALL
161175
volumeMounts:
162176
- mountPath: /csi
163177
name: socket-dir
@@ -186,6 +200,9 @@ spec:
186200
imagePullPolicy: IfNotPresent
187201
securityContext:
188202
privileged: true
203+
capabilities:
204+
drop:
205+
- ALL
189206
resources:
190207
limits:
191208
memory: 100Mi

‎deploy/v1.22.6/csi-blob-node.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ spec:
4646
- "/blobfuse-proxy/init.sh"
4747
securityContext:
4848
privileged: true
49+
capabilities:
50+
drop:
51+
- ALL
4952
env:
5053
- name: DEBIAN_FRONTEND
5154
value: "noninteractive"
@@ -87,6 +90,10 @@ spec:
8790
requests:
8891
cpu: 10m
8992
memory: 20Mi
93+
securityContext:
94+
capabilities:
95+
drop:
96+
- ALL
9097
- name: node-driver-registrar
9198
image: mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar:v2.8.0
9299
args:
@@ -117,6 +124,10 @@ spec:
117124
requests:
118125
cpu: 10m
119126
memory: 20Mi
127+
securityContext:
128+
capabilities:
129+
drop:
130+
- ALL
120131
- name: blob
121132
image: mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.22.6
122133
imagePullPolicy: IfNotPresent
@@ -157,6 +168,9 @@ spec:
157168
fieldPath: spec.nodeName
158169
securityContext:
159170
privileged: true
171+
capabilities:
172+
drop:
173+
- ALL
160174
volumeMounts:
161175
- mountPath: /csi
162176
name: socket-dir

‎deploy/v1.24.1/csi-blob-node.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ spec:
4646
- "/blobfuse-proxy/init.sh"
4747
securityContext:
4848
privileged: true
49+
capabilities:
50+
drop:
51+
- ALL
4952
env:
5053
- name: DEBIAN_FRONTEND
5154
value: "noninteractive"
@@ -89,6 +92,10 @@ spec:
8992
requests:
9093
cpu: 10m
9194
memory: 20Mi
95+
securityContext:
96+
capabilities:
97+
drop:
98+
- ALL
9299
- name: node-driver-registrar
93100
image: mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar:v2.10.1
94101
args:
@@ -119,6 +126,10 @@ spec:
119126
requests:
120127
cpu: 10m
121128
memory: 20Mi
129+
securityContext:
130+
capabilities:
131+
drop:
132+
- ALL
122133
- name: blob
123134
image: mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.24.1
124135
imagePullPolicy: IfNotPresent
@@ -158,6 +169,9 @@ spec:
158169
fieldPath: spec.nodeName
159170
securityContext:
160171
privileged: true
172+
capabilities:
173+
drop:
174+
- ALL
161175
volumeMounts:
162176
- mountPath: /csi
163177
name: socket-dir
@@ -186,6 +200,9 @@ spec:
186200
imagePullPolicy: IfNotPresent
187201
securityContext:
188202
privileged: true
203+
capabilities:
204+
drop:
205+
- ALL
189206
resources:
190207
limits:
191208
memory: 100Mi

0 commit comments

Comments
 (0)