[stable/nfs-client-provisioner] Revert running as nobody (#12580)

* Revert "stable/nfs-client-provisioner: run as nobody (#12180)"

This reverts commit c390904bcc.

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* update version

Signed-off-by: Bart Verwilst <bart@verwilst.be>

stable/nfs-client-provisioner/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: 3.1.0
 description: nfs-client is an automatic provisioner that used your *already configured* NFS server, automatically creating Persistent Volumes.
 name: nfs-client-provisioner
 home: https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
-version: 1.2.4
+version: 1.2.5
 sources:
 - https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
 maintainers:

stable/nfs-client-provisioner/templates/clusterrole.yaml

@@ -21,4 +21,10 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "update", "patch"]
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
+{{- end }}
 {{- end }}

stable/nfs-client-provisioner/templates/deployment.yaml

@@ -34,9 +34,6 @@ spec:
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
       {{- end }}
-      securityContext:
-        runAsUser: 65534
-        fsGroup: 65534
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "nfs-client-provisioner.fullname" . }}
+  labels:
+    app: {{ template "nfs-client-provisioner.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - 'secret'
+    - 'nfs'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  readOnlyRootFilesystem: false
+{{- end }}

stable/nfs-client-provisioner/templates/role.yaml

@@ -12,4 +12,10 @@ rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
+{{- end }}
 {{- end }}

stable/nfs-client-provisioner/values.yaml

@@ -44,6 +44,11 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
 
+# If true, create & use Pod Security Policy resources
+# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+podSecurityPolicy:
+  enabled: false
+
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
   create: true