Add support for Kubernetes Pod Security Policy

[ghost]

Is your feature request related to a problem?/Why is this needed We run secure Kubernetes 1.16+ environments where Pod Security Policies (PSP) is required for any Pod to start. When we deploy the helm package for the SMB FlexVolume plugin it fails to start

Describe the solution you'd like in detail The helm package includes PSP support, including creating the service account under which the installer pod runs as.

Describe alternatives you've considered Manually create the required Kubernetes definitions to support PSP, including post-installation change to the installer's deployment - however it's more effective to have that supported out of the box.

Additional context See https://kubernetes.io/docs/concepts/policy/pod-security-policy/

[andyzhangx]

do you have more details? How can I solve this issue?

[ghost]

Here what we did:

1. create a Kubernetes Pod Security Policy that describes the permissions required for the installer, specifically: a. it needs access to the following path in the host node: i. /var/log/ ii. the path specified by the 'flexVolumePluginPath' variable, in our case that's /usr/libexec/kubernetes/kubelet-plugins/volume/exec/ b. it needs access to the following type of volume: i. secrets ii. hostPath
2. create a service account and a. a role that reference the above PSP b. a role binding that associate the service account to the role
3. update the smb-flexvol-installer.yaml so that the deployment specify that the 'smb-flexvol-installer' container runs as the above service account

for the purpose of this issue case, you probably want to make this as an optional parameter like "psp.enabled=true" and "serviceaccount.create=true".

[andyzhangx]

hi @mchuegeh, we are now moving to https://github.com/kubernetes-csi/csi-driver-smb, do you have time contributing to this project? thanks.