stable/nfs-client-provisioner: run as nobody (#12180)

if in a k8s-cluster a psp disallow running containers as root, this
PR will run the nfs-client-provisioner as user nobody.

the psp isn't required anymore

Signed-off-by: Mario Constanti <github@constanti.de>

stable/nfs-client-provisioner/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: 3.1.0
 description: nfs-client is an automatic provisioner that used your *already configured* NFS server, automatically creating Persistent Volumes.
 name: nfs-client-provisioner
 home: https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
-version: 1.2.3
+version: 1.2.4
 sources:
 - https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
 maintainers:

stable/nfs-client-provisioner/templates/clusterrole.yaml

@@ -21,10 +21,4 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "update", "patch"]
-{{- if .Values.podSecurityPolicy.enabled }}
-  - apiGroups:      ['extensions']
-    resources:      ['podsecuritypolicies']
-    verbs:          ['use']
-    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
-{{- end }}
 {{- end }}

stable/nfs-client-provisioner/templates/deployment.yaml

@@ -34,6 +34,9 @@ spec:
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
       {{- end }}
+      securityContext:
+        runAsUser: 65534
+        fsGroup: 65534
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml

@@ -1,31 +0,0 @@
-{{- if .Values.podSecurityPolicy.enabled }}
-apiVersion: extensions/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: {{ template "nfs-client-provisioner.fullname" . }}
-  labels:
-    app: {{ template "nfs-client-provisioner.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-    - ALL
-  volumes:
-    - 'secret'
-    - 'nfs'
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'RunAsAny'
-  fsGroup:
-    rule: 'RunAsAny'
-  readOnlyRootFilesystem: false
-{{- end }}

stable/nfs-client-provisioner/templates/role.yaml

@@ -12,10 +12,4 @@ rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
-{{- if .Values.podSecurityPolicy.enabled }}
-  - apiGroups:      ['extensions']
-    resources:      ['podsecuritypolicies']
-    verbs:          ['use']
-    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
-{{- end }}
 {{- end }}

stable/nfs-client-provisioner/values.yaml

@@ -44,11 +44,6 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
 
-# If true, create & use Pod Security Policy resources
-# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
-podSecurityPolicy:
-  enabled: false
-
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
   create: true