Merge pull request #87 from cheyang/helm-chart-fluid-1.0.5-alpha.4

Add helm-chart-fluid-1.0.5-alpha.4
fluid-cloudnative · Feb 20, 2025 · bbf63bc · bbf63bc
2 parents 4d99420 + f7928c1
commit bbf63bc
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 7 deletions.
diff --git a/charts/fluid/Chart.yaml b/charts/fluid/Chart.yaml
@@ -14,11 +14,11 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 1.0.5-alpha.3
+version: 1.0.5-alpha.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 1.0.5-c0b41c2
+appVersion: 1.0.5-0ca6855
 home: https://github.com/fluid-cloudnative/fluid
 keywords:
   - category:data

diff --git a/charts/fluid/templates/csi/daemonset.yaml b/charts/fluid/templates/csi/daemonset.yaml
@@ -112,6 +112,7 @@ spec:
           - name: fluid-src-dir
             mountPath: {{ .Values.runtime.mountRoot | quote }}
             mountPropagation: "HostToContainer"
+          {{- if .Values.csi.useNodeAuthorization }}
           - name: kubelet-kube-config
             mountPath: /etc/kubernetes/kubelet.conf
             mountPropagation: "HostToContainer"
@@ -123,6 +124,7 @@ spec:
             mountPath: {{ .Values.csi.kubelet.certDir | quote }}
             readOnly: true
           {{- end }}
+          {{- end }}
           - name: updatedb-conf
             mountPath: /host-etc/updatedb.conf
           - name: updatedb-conf-bak
@@ -132,12 +134,19 @@ spec:
           hostPath:
             path: {{ .Values.csi.kubelet.rootDir | quote }}
             type: Directory
+        {{- if .Values.csi.useNodeAuthorization }}
+        {{- $kubeletRootDir := ternary ( .Values.csi.kubelet.rootDir ) ( print .Values.csi.kubelet.rootDir "/" ) ( hasSuffix "/" .Values.csi.kubelet.rootDir ) }}
         {{- if not ( hasPrefix $kubeletRootDir .Values.csi.kubelet.certDir ) }}
         - name: kubelet-cert-dir
           hostPath:
             path: {{ .Values.csi.kubelet.certDir | quote }}
             type: Directory
         {{- end }}
+        - name: kubelet-kube-config
+          hostPath:
+            path: {{ .Values.csi.kubelet.kubeConfigFile | quote }}
+            type: File
+        {{- end }}
         - name: plugin-dir
           hostPath:
             path: {{ .Values.csi.kubelet.rootDir }}/plugins/csi-fluid-plugin
@@ -150,10 +159,6 @@ spec:
             path: {{ .Values.runtime.mountRoot | quote }}
             type: DirectoryOrCreate
           name: fluid-src-dir
-        - hostPath:
-            path: {{ .Values.csi.kubelet.kubeConfigFile | quote }}
-            type: File
-          name: kubelet-kube-config
         - hostPath:
             path: /etc/updatedb.conf
             type: FileOrCreate

diff --git a/charts/fluid/templates/role/csi/rbac.yaml b/charts/fluid/templates/role/csi/rbac.yaml
@@ -44,6 +44,11 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "patch"]
+  {{- if not .Values.csi.useNodeAuthorization }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "patch"]
+  {{- end }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/charts/fluid/values.yaml b/charts/fluid/values.yaml
@@ -14,7 +14,7 @@ image:
 # Default registry, namespace and version tag for images managed by fluid
 imagePrefix: &defaultImagePrefix fluidcloudnative
 # imagePrefix: &defaultImagePrefix registry.aliyuncs.com/fluid
-version: &defaultVersion v1.0.5-c0b41c2
+version: &defaultVersion v1.0.5-0ca6855
 
 crdUpgrade:
   enabled: true
@@ -58,6 +58,10 @@ csi:
     imagePrefix: *defaultImagePrefix
     imageName: fluid-csi
     imageTag: *defaultVersion
+  # Whether or not to borrow kubelet's config file to use node authorization to restrict CSI Plugin's permission
+  # See why Fluid's CSI Plugins need node-specific authorization at https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-93xx-cvmc-9w3v
+  # See node authorization at https://kubernetes.io/docs/reference/access-authn-authz/node/
+  useNodeAuthorization: true
   kubelet:
     kubeConfigFile: /etc/kubernetes/kubelet.conf
     certDir: /var/lib/kubelet/pki