Scan Remediation: csi-plugin-provisioner.yaml.j2

[ibm]

Scan Remediation: csi-plugin-provisioner.yaml.j2

[mew2057]

@smitaraut @dunnevan @yadaven @aspalazz :
A few problems that I don't have answers for:

• The lint requires that we drop security privileges and then request the privileges we need. I know for openshift, we need privilege mode, but this could be a

• For resources we need to define the minimum and maximum allowed CPU, per container. Getting this perfectly correct is not a huge deal, because it's a compressible value.

• For resources we need to define the minimum and maximum allowed Memory usage per container. Getting this right is a huge deal, because if we don't give the container enough, it will restart.

• hostPath is apparently taboo in CloudPak land, so we need to address that.

• We need a livenessProbe for the containers. For the operator I just used a dummy script, because block did something similar.

• beta.kubernetes.io/arch I think I fixed this one with the operator, because this has been replaced with kubernetes.io/arch.

---

This is literally a jinja2 template of https://github.com/IBM/ibm-spectrum-scale-csi-driver/blob/master/deploy/csi-plugin-provisioner.yaml_template

[smitaraut]

Is this still valid?

[mew2057]

Technically yes, we still need a liveness probe and resource management, but apparently the rest were less of an issue.

[deeghuge]

Duplicate of issue #467