Remove `hostPID: true` from the nodeplugin pod spec

[Jeansen]

I have a critical warning in my local playground cluster that reads like the following:

Sharing the host PID namespace lets the container see and signal all host processes, enabling process injection attacks.

K8s: Pod Security Standards
NSA/CISA Kubernetes Hardening Guide

DAEMONSET
rook-ceph / rook-ceph.rbd.csi.ceph.com-nodeplugin

Rook-Ceph version (Operator and Cluster): 1.19.7

For reference: I first opened it up here: rook/rook#18032 (comment)

[nixpanic]

hostPID is required for Running CephCSI with pod networking. This feature requires access to the processes on the host (or an other container) so that nsenter can be used to run (mount)processes in a different Linux kernel namespace than that of the current container.

We've evaluated this a little more. The feature is not commonly used, and can be deprecated.

When setting hostPID: false, everything is expected to work as intended (except for the above mentioned feature). Because deploying Ceph-CSI is commonly done by ceph-csi-operator, the hostPID: true setting should be removed there as well.

[nixpanic]

Deprecation of node-plugin with Pod networking/restarts will be included in v3.18.0, with removal of the feature in v3.19.0.

[Jeansen]

OK, great. Thank you. Should we keep this issu open then for reference?

[nixpanic]

OK, great. Thank you. Should we keep this issue open then for reference?

Yes, it has been added to the v3.19 milestone so that we won't forget about it.