helm fixes

openstack/deployments/openstack-cinder-csi-result.yaml

@@ -222,8 +222,9 @@ metadata:
     component: nodeplugin
     app: openstack-cinder-csi
     release: openstack-cloud-controller-manager
-    chart: openstack-cinder-csi-2.27.1
+    chart: openstack-cinder-csi-2.28.0-alpha.4
     heritage: Helm
+  annotations:
 spec:
   selector:
     matchLabels:
@@ -236,13 +237,20 @@ spec:
         component: nodeplugin
         app: openstack-cinder-csi
         release: openstack-cloud-controller-manager
-        chart: openstack-cinder-csi-2.27.1
+        chart: openstack-cinder-csi-2.28.0-alpha.4
         heritage: Helm
+      annotations:
     spec:
       serviceAccount: csi-cinder-node-sa
       hostNetwork: true
       containers:
         - name: node-driver-registrar
+          securityContext:
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
           image: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.6.2"
           imagePullPolicy: IfNotPresent
           args:
@@ -266,6 +274,12 @@ spec:
           resources: 
             {}
         - name: liveness-probe
+          securityContext:
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
           image: "registry.k8s.io/sig-storage/livenessprobe:v2.9.0"
           imagePullPolicy: IfNotPresent
           args:
@@ -362,8 +376,9 @@ metadata:
     component: controllerplugin
     app: openstack-cinder-csi
     release: openstack-cloud-controller-manager
-    chart: openstack-cinder-csi-2.27.1
+    chart: openstack-cinder-csi-2.28.0-alpha.4
     heritage: Helm
+  annotations:
 spec:
   replicas: 1
   strategy:
@@ -382,12 +397,17 @@ spec:
         component: controllerplugin
         app: openstack-cinder-csi
         release: openstack-cloud-controller-manager
-        chart: openstack-cinder-csi-2.27.1
+        chart: openstack-cinder-csi-2.28.0-alpha.4
         heritage: Helm
+      annotations:
     spec:
       serviceAccount: csi-cinder-controller-sa
+      securityContext:
+        {}
       containers:
         - name: csi-attacher
+          securityContext:
+            {}
           image: "registry.k8s.io/sig-storage/csi-attacher:v4.2.0"
           imagePullPolicy: IfNotPresent
           args:
@@ -405,6 +425,8 @@ spec:
           resources: 
             {}
         - name: csi-provisioner
+          securityContext:
+            {}
           image: "registry.k8s.io/sig-storage/csi-provisioner:v3.4.1"
           imagePullPolicy: IfNotPresent
           args:
@@ -424,6 +446,8 @@ spec:
           resources: 
             {}
         - name: csi-snapshotter
+          securityContext:
+            {}
           image: "registry.k8s.io/sig-storage/csi-snapshotter:v6.2.1"
           imagePullPolicy: IfNotPresent
           args:
@@ -440,7 +464,9 @@ spec:
           resources: 
             {}
         - name: csi-resizer
-          image: "registry.k8s.io/sig-storage/csi-resizer:v1.7.0"
+          securityContext:
+            {}
+          image: "registry.k8s.io/sig-storage/csi-resizer:v1.8.0"
           imagePullPolicy: IfNotPresent
           args:
             - "-v=2"
@@ -457,6 +483,8 @@ spec:
           resources: 
             {}
         - name: liveness-probe
+          securityContext:
+            {}
           image: "registry.k8s.io/sig-storage/livenessprobe:v2.9.0"
           imagePullPolicy: IfNotPresent
           args:
@@ -471,6 +499,8 @@ spec:
           resources: 
             {}
         - name: cinder-csi-plugin
+          securityContext:
+            {}
           image: "registry.k8s.io/provider-os/cinder-csi-plugin:v1.27.1"
           imagePullPolicy: IfNotPresent
           args:

openstack/deployments/openstack-cloud-controller-manager-result.yaml

@@ -177,7 +177,7 @@ spec:
             - --use-service-account-credentials=true
             - --controllers=cloud-node-lifecycle
             - --bind-address=127.0.0.1
-            - --leader-elect-resource-name=cloud-controller-manager-openstack
+            - --leader-elect-resource-name=openstack-cloud-controller-manager
           volumeMounts:
             - mountPath: /etc/config
               name: cloud-config-volume

openstack/deployments/openstack-csi.yaml

@@ -1,6 +1,7 @@
 
 secret:
   enabled: true
+  hostMount: false
   create: false
   name: openstack-cloud-controller-manager
 
@@ -9,10 +10,19 @@ storageClass:
 
 csi:
   plugin:
-    # volumes: []
-    # volumeMounts: []
+    volumes: []
+    volumeMounts:
+      - mountPath: /etc/kubernetes
+        name: cloud-config
+        readOnly: true
 
     nodePlugin:
+      securityContext:
+        capabilities:
+          drop:
+          - ALL
+        seccompProfile:
+          type: RuntimeDefault
       nodeSelector:
         node.cloudprovider.kubernetes.io/platform: openstack
       tolerations: