HostPath requirement

[janethavi]

I am using the CSI driver provider and on Azure and there is a security recommendation as follows Kubernetes cluster pod hostPath volumes should only use allowed host paths. For this recommendation, this pod is caught as a vulnerability. Following are the two HostPaths /etc/kubernetes/secrets-store-csi-providers and /var/lib/kubelet/pods. Are these HostPaths required and mandatory? If not, is there a way of disabling these HostPaths?

[aramase]

Which version of the driver and provider are you running in the cluster?

• /var/lib/kubelet/pods is required for the driver: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/deploy/secrets-store-csi-driver.yaml#L94. This is the volume directory for pods and the target path in this dir is mounted into the pod as tmpfs.
• /etc/kubernetes/secrets-store-csi-providers is used for the unix socket that enable driver <-> provider communication. If you don't wish to use /etc/kubernetes/secrets-store-csi-providers, then you can change that to a different path that's allowed. Note, this change has to be made in all the yamls for the driver and provider and is also customisable with helm.

[janethavi]

Thank you!