-
Notifications
You must be signed in to change notification settings - Fork 24
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provisioner pod created in default namespace #92
Comments
It is up to you where the provisioner is deployed, the driver itself has not preference |
We did several checks on deploying test pods to different namespaces and made sure that the provisioner pod always runs in the "default" namespace. |
I have problems understanding what you are aiming for, maybe you can create a PR which shows the Problem. |
I'm trying to deploy a test pod apiVersion: v1
kind: Pod
metadata:
name: busybox
namespace: csi-lvm-system
spec:
containers:
- name: hello-container
image: busybox
command: ["sh","-c","sleep 3600"]
volumeMounts:
- mountPath: /mnt/store
name: storage
volumes:
- name: storage
persistentVolumeClaim:
claimName: storage-claim
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: storage-claim
namespace: csi-lvm-system
spec:
storageClassName: csi-driver-lvm-linear
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi In whatever namespace I deploy this pod to "default", "test", "csi-lvm-system", the pod responsible for creating lv (create-pvc- ххххххх) is always deployed in the "default" namespace. Since "create-pvc-ххххххх" is privileged, it would be logical to create it in the namespace of the "csi-lvm-system" driver itself, apply annotations only to it, and not to the default namespace
|
Maybe we can just create a pull request for a flag ( We can use environment field refs for injecting the namespace in our manifests and helm-charts like:
This resolves the problem, right? |
I think yes, it does. Thank you |
Hey @aivanov-citc, I just looked at the problem and found out a few things. There is already a The flag is set through the helm-chart automatically: https://github.com/metal-stack/helm-charts/blob/v0.3.32/charts/csi-driver-lvm/templates/plugin.yaml#L176. Did you deploy this project through our helm repo? Otherwise, maybe you missed setting the existing In #93, I created a branch that activates Pod Security on the Kind cluster. For the integration tests, I deployed the driver to a dedicated
|
Hey @Gerrit91. |
Talos clusters use Pod Security Standards by default and do not allow the creation of privileged pods. To create privileged pods in a namespace, you need to add special annotations to the namespace.
Now the Provisioner Pod is created in the default namespace
Since the Provisioner Pod is privileged, please create a Provisioner Pod in the namespace csi-driver-lvm so as not to add annotations to the default namespace
The text was updated successfully, but these errors were encountered: