diff --git a/pkg/operator/ceph/cluster/cleanup.go b/pkg/operator/ceph/cluster/cleanup.go index 92b293359..b96f6bff9 100644 --- a/pkg/operator/ceph/cluster/cleanup.go +++ b/pkg/operator/ceph/cluster/cleanup.go @@ -161,6 +161,7 @@ func (c *ClusterController) cleanUpJobTemplateSpec(cluster *cephv1.CephCluster, Volumes: volumes, RestartPolicy: v1.RestartPolicyOnFailure, PriorityClassName: cephv1.GetCleanupPriorityClassName(cluster.Spec.PriorityClassNames), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/mgr/spec.go b/pkg/operator/ceph/cluster/mgr/spec.go index 01cfb5f2b..be2ea0347 100644 --- a/pkg/operator/ceph/cluster/mgr/spec.go +++ b/pkg/operator/ceph/cluster/mgr/spec.go @@ -61,6 +61,7 @@ func (c *Cluster) makeDeployment(mgrConfig *mgrConfig) (*apps.Deployment, error) Containers: []v1.Container{ c.makeMgrDaemonContainer(mgrConfig), }, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: serviceAccountName, RestartPolicy: v1.RestartPolicyAlways, Volumes: volumes, diff --git a/pkg/operator/ceph/cluster/mon/spec.go b/pkg/operator/ceph/cluster/mon/spec.go index 9d79ace7b..aea546dac 100644 --- a/pkg/operator/ceph/cluster/mon/spec.go +++ b/pkg/operator/ceph/cluster/mon/spec.go @@ -189,6 +189,7 @@ func (c *Cluster) makeMonPod(monConfig *monConfig, canary bool) (*corev1.Pod, er Volumes: controller.DaemonVolumesBase(monConfig.DataPathMap, keyringStoreName, c.spec.DataDirHostPath), HostNetwork: monConfig.UseHostNetwork, PriorityClassName: cephv1.GetMonPriorityClassName(c.spec.PriorityClassNames), + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/crash.go b/pkg/operator/ceph/cluster/nodedaemon/crash.go index 87ed94fb7..9f3eb43bc 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/crash.go +++ b/pkg/operator/ceph/cluster/nodedaemon/crash.go @@ -121,6 +121,7 @@ func (r *ReconcileNode) createOrUpdateCephCrash(node corev1.Node, tolerations [] HostNetwork: cephCluster.Spec.Network.IsHost(), Volumes: volumes, PriorityClassName: cephv1.GetCrashCollectorPriorityClassName(cephCluster.Spec.PriorityClassNames), + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/exporter.go b/pkg/operator/ceph/cluster/nodedaemon/exporter.go index a92834ccb..52beea0ad 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/exporter.go +++ b/pkg/operator/ceph/cluster/nodedaemon/exporter.go @@ -143,6 +143,7 @@ func (r *ReconcileNode) createOrUpdateCephExporter(node corev1.Node, tolerations Volumes: volumes, PriorityClassName: cephv1.GetCephExporterPriorityClassName(cephCluster.Spec.PriorityClassNames), TerminationGracePeriodSeconds: &terminationGracePeriodSeconds, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/nodedaemon/pruner.go b/pkg/operator/ceph/cluster/nodedaemon/pruner.go index bb8e3966b..1f6951690 100644 --- a/pkg/operator/ceph/cluster/nodedaemon/pruner.go +++ b/pkg/operator/ceph/cluster/nodedaemon/pruner.go @@ -110,6 +110,7 @@ func (r *ReconcileNode) createOrUpdateCephCron(cephCluster cephv1.CephCluster, c RestartPolicy: corev1.RestartPolicyNever, HostNetwork: cephCluster.Spec.Network.IsHost(), Volumes: volumes, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/cluster/osd/key_rotation.go b/pkg/operator/ceph/cluster/osd/key_rotation.go index b1af021af..0905b71d9 100644 --- a/pkg/operator/ceph/cluster/osd/key_rotation.go +++ b/pkg/operator/ceph/cluster/osd/key_rotation.go @@ -161,6 +161,7 @@ func (c *Cluster) getKeyRotationPodTemplateSpec(osdProps osdProperties, osd OSDI HostNetwork: c.spec.Network.IsHost(), PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames), SchedulerName: osdProps.schedulerName, + SecurityContext: &v1.PodSecurityContext{}, }, } if c.spec.Network.IsHost() { diff --git a/pkg/operator/ceph/cluster/osd/provision_spec.go b/pkg/operator/ceph/cluster/osd/provision_spec.go index 9e3673dfb..209861c5d 100644 --- a/pkg/operator/ceph/cluster/osd/provision_spec.go +++ b/pkg/operator/ceph/cluster/osd/provision_spec.go @@ -157,6 +157,7 @@ func (c *Cluster) provisionPodTemplateSpec(osdProps osdProperties, restart v1.Re HostNetwork: c.spec.Network.IsHost(), PriorityClassName: cephv1.GetOSDPriorityClassName(c.spec.PriorityClassNames), SchedulerName: osdProps.schedulerName, + SecurityContext: &v1.PodSecurityContext{}, } if c.spec.Network.IsHost() { podSpec.DNSPolicy = v1.DNSClusterFirstWithHostNet diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index 74ac41de2..98d927564 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -651,8 +651,9 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd OSDInfo, provisionC WorkingDir: opconfig.VarLogCephDir, }, }, - Volumes: volumes, - SchedulerName: osdProps.schedulerName, + Volumes: volumes, + SecurityContext: &v1.PodSecurityContext{}, + SchedulerName: osdProps.schedulerName, }, } diff --git a/pkg/operator/ceph/cluster/rbd/spec.go b/pkg/operator/ceph/cluster/rbd/spec.go index 2b846eae8..217bdf1e2 100644 --- a/pkg/operator/ceph/cluster/rbd/spec.go +++ b/pkg/operator/ceph/cluster/rbd/spec.go @@ -43,6 +43,7 @@ func (r *ReconcileCephRBDMirror) makeDeployment(daemonConfig *daemonConfig, rbdM Volumes: controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath), HostNetwork: r.cephClusterSpec.Network.IsHost(), PriorityClassName: rbdMirror.Spec.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/controller/cleanup.go b/pkg/operator/ceph/controller/cleanup.go index 99a4a60ef..739cce905 100644 --- a/pkg/operator/ceph/controller/cleanup.go +++ b/pkg/operator/ceph/controller/cleanup.go @@ -129,6 +129,7 @@ func (c *ResourceCleanup) jobTemplateSpec() v1.PodTemplateSpec { Volumes: volumes, RestartPolicy: v1.RestartPolicyOnFailure, PriorityClassName: cephv1.GetCleanupPriorityClassName(c.cluster.Spec.PriorityClassNames), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml index 74937c30f..09d4c305a 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-cephfs-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml index 16784c0cd..41bddfb0b 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-provisioner-dep.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-cephfs-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml index 1f2b306e4..d1077a549 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml @@ -22,6 +22,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-cephfs-plugin-sa hostNetwork: {{ .EnableCSIHostNetwork }} {{ if .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml index 5ee0e6f06..f0143f424 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-nfs-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml index a9e2124a3..325c2594f 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin-provisioner-dep.yaml @@ -16,6 +16,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-nfs-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml index 2572a205e..d39f20012 100644 --- a/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml +++ b/pkg/operator/ceph/csi/template/nfs/csi-nfsplugin.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-nfs-plugin-sa hostNetwork: {{ .EnableCSIHostNetwork }} {{ if .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml index 9be084d4b..2acd7d5fc 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml @@ -29,6 +29,7 @@ spec: spec: # HostPID is needed to expose the correct process ID network namespace and not the process namespace hostPID: true + securityContext: {} serviceAccountName: rook-csi-rbd-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml index f96451f43..da4661e47 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-provisioner-dep.yaml @@ -17,6 +17,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-rbd-provisioner-sa {{ if .ProvisionerPriorityClassName }} priorityClassName: {{ .ProvisionerPriorityClassName }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml index 960598ace..ef8d0cfc8 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml @@ -22,6 +22,7 @@ spec: {{ $key }}: "{{ $value }}" {{ end }} spec: + securityContext: {} serviceAccountName: rook-csi-rbd-plugin-sa {{ if .PluginPriorityClassName }} priorityClassName: {{ .PluginPriorityClassName }} diff --git a/pkg/operator/ceph/file/mds/spec.go b/pkg/operator/ceph/file/mds/spec.go index 426957a24..625792a85 100644 --- a/pkg/operator/ceph/file/mds/spec.go +++ b/pkg/operator/ceph/file/mds/spec.go @@ -65,6 +65,7 @@ func (c *Cluster) makeDeployment(mdsConfig *mdsConfig, fsNamespacedname types.Na Volumes: controller.DaemonVolumes(mdsConfig.DataPathMap, mdsConfig.ResourceName, c.clusterSpec.DataDirHostPath), HostNetwork: c.clusterSpec.Network.IsHost(), PriorityClassName: c.fs.Spec.MetadataServer.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/file/mirror/spec.go b/pkg/operator/ceph/file/mirror/spec.go index 8e9153b5b..caa936444 100644 --- a/pkg/operator/ceph/file/mirror/spec.go +++ b/pkg/operator/ceph/file/mirror/spec.go @@ -46,6 +46,7 @@ func (r *ReconcileFilesystemMirror) makeDeployment(daemonConfig *daemonConfig, f Volumes: controller.DaemonVolumes(daemonConfig.DataPathMap, daemonConfig.ResourceName, r.cephClusterSpec.DataDirHostPath), HostNetwork: r.cephClusterSpec.Network.IsHost(), PriorityClassName: fsMirror.Spec.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, }, } diff --git a/pkg/operator/ceph/nfs/spec.go b/pkg/operator/ceph/nfs/spec.go index 10edf9399..e8e459743 100644 --- a/pkg/operator/ceph/nfs/spec.go +++ b/pkg/operator/ceph/nfs/spec.go @@ -149,6 +149,7 @@ func (r *ReconcileCephNFS) makeDeployment(nfs *cephv1.CephNFS, cfg daemonConfig) // connecting to the krb server. give all ganesha servers the same hostname so they can all // use the same krb credentials to auth Hostname: fmt.Sprintf("%s-%s", nfs.Namespace, nfs.Name), + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } // Replace default unreachable node toleration diff --git a/pkg/operator/ceph/object/cosi/spec.go b/pkg/operator/ceph/object/cosi/spec.go index 12674353f..c9c7c8a8e 100644 --- a/pkg/operator/ceph/object/cosi/spec.go +++ b/pkg/operator/ceph/object/cosi/spec.go @@ -87,6 +87,7 @@ func createCOSIPodSpec(cephCOSIDriver *cephv1.CephCOSIDriver) (corev1.PodTemplat cosiDriverContainer, cosiSideCarContainer, }, + SecurityContext: &corev1.PodSecurityContext{}, ServiceAccountName: DefaultServiceAccountName, Volumes: []corev1.Volume{ {Name: cosiSocketVolumeName, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}}, diff --git a/pkg/operator/ceph/object/spec.go b/pkg/operator/ceph/object/spec.go index 3213cc435..ff59930dc 100644 --- a/pkg/operator/ceph/object/spec.go +++ b/pkg/operator/ceph/object/spec.go @@ -152,6 +152,7 @@ func (c *clusterConfig) makeRGWPodSpec(rgwConfig *rgwConfig) (v1.PodTemplateSpec ), HostNetwork: hostNetwork, PriorityClassName: c.store.Spec.Gateway.PriorityClassName, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: serviceAccountName, } diff --git a/pkg/operator/discover/discover.go b/pkg/operator/discover/discover.go index bf543524b..7e53ec45e 100644 --- a/pkg/operator/discover/discover.go +++ b/pkg/operator/discover/discover.go @@ -175,6 +175,7 @@ func (d *Discover) createDiscoverDaemonSet(ctx context.Context, namespace, disco }, HostNetwork: false, PriorityClassName: k8sutil.GetValue(data, discoverDaemonsetPriorityClassNameEnv, ""), + SecurityContext: &v1.PodSecurityContext{}, }, }, }, diff --git a/pkg/operator/k8sutil/cmdreporter/cmdreporter.go b/pkg/operator/k8sutil/cmdreporter/cmdreporter.go index affc87558..c40e58afc 100644 --- a/pkg/operator/k8sutil/cmdreporter/cmdreporter.go +++ b/pkg/operator/k8sutil/cmdreporter/cmdreporter.go @@ -301,6 +301,7 @@ func (cr *cmdReporterCfg) initJobSpec() (*batch.Job, error) { *cmdReporterContainer, }, RestartPolicy: v1.RestartPolicyOnFailure, + SecurityContext: &v1.PodSecurityContext{}, ServiceAccountName: k8sutil.DefaultServiceAccount, } copyBinsVol, _ := copyBinariesVolAndMount()