osd: add CAP_MKNOD to PSP

This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job creating pods under PSP-enabled Kubernetes cluster. Signed-off-by: Yuichiro Ueno <ueno@preferred.jp> (cherry picked from commit bae6351)
rook · Dec 16, 2021 · 0d3462b · 0d3462b
1 parent 7b9c691
commit 0d3462b
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/build/rbac/rbac.yaml b/build/rbac/rbac.yaml
@@ -702,6 +702,7 @@ spec:
   allowedCapabilities:
     # required by CSI
     - SYS_ADMIN
+    - MKNOD
   fsGroup:
     rule: RunAsAny
   # runAsUser, supplementalGroups - Rook needs to run some pods as root

diff --git a/deploy/charts/rook-ceph/templates/psp.yaml b/deploy/charts/rook-ceph/templates/psp.yaml
@@ -21,6 +21,7 @@ spec:
   allowedCapabilities:
     # required by CSI
     - SYS_ADMIN
+    - MKNOD
   fsGroup:
     rule: RunAsAny
   # runAsUser, supplementalGroups - Rook needs to run some pods as root

diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml
@@ -718,6 +718,7 @@ spec:
   allowedCapabilities:
     # required by CSI
     - SYS_ADMIN
+    - MKNOD
   fsGroup:
     rule: RunAsAny
   # runAsUser, supplementalGroups - Rook needs to run some pods as root