Deprecate netNamespaceFilePath for Pod networking/restart feature - #6436
Open
nixpanic wants to merge 4 commits into
Open
Deprecate netNamespaceFilePath for Pod networking/restart feature#6436nixpanic wants to merge 4 commits into
nixpanic wants to merge 4 commits into
Conversation
Make hostPID configurable in Helm charts by automatically detecting when netNamespaceFilePath is configured in csiConfig. This provides a secure default (hostPID not set, defaults to false) while enabling it only when network namespace isolation is required. Changes: - RBD: Check for .rbd.netNamespaceFilePath in csiConfig - CephFS: Check for .cephFS.netNamespaceFilePath in csiConfig - Only set hostPID: true when netNamespaceFilePath is present - Remove hostPID from values.yaml (no longer needed) This matches the pattern used in deploy/ directory where hostPID is set to false by default with a comment explaining when to enable it. Assisted-by: AskBob <askbob@ibm.com> Signed-off-by: Niels de Vos <ndevos@ibm.com>
Change hostPID from true to false in all plugin DaemonSets and the SecurityContextConstraints. Add a comment explaining that hostPID should be set to true when netNamespaceFilePath is configured. This provides a more secure default while still allowing users to enable hostPID when needed for network namespace isolation. Files updated: - deploy/cephfs/kubernetes/csi-cephfsplugin.yaml - deploy/nfs/kubernetes/csi-nfsplugin.yaml - deploy/rbd/kubernetes/csi-rbdplugin.yaml - deploy/nvmeof/kubernetes/csi-nvmeofplugin.yaml - api/deploy/ocp/scc.yaml (template) - deploy/scc.yaml (regenerated from template) Assisted-by: AskBob <askbob@ibm.com> Signed-off-by: Niels de Vos <ndevos@ibm.com>
Add a deprecation notice in the examples README to inform users that the netNamespaceFilePath feature is deprecated and will be removed in a future version. Users should migrate to using host networking for CSI plugin pods. Assisted-by: AskBob <askbob@ibm.com> Signed-off-by: Niels de Vos <ndevos@ibm.com>
nixpanic
force-pushed
the
deprecation/netNamespaceFilePath
branch
from
July 29, 2026 13:04
97be30c to
16f4f52
Compare
Member
Author
|
/test ci/centos/mini-e2e/k8s-1.37 |
Member
Author
Running at https://jenkins-ceph-csi.apps.ocp.cloud.ci.centos.org/job/mini-e2e_k8s-1.37/4/display/redirect |
nixpanic
force-pushed
the
deprecation/netNamespaceFilePath
branch
from
July 29, 2026 13:36
16f4f52 to
c16a5ba
Compare
Add a deprecation warning when netNamespaceFilePath is configured in the CSI configuration. This warns users that the feature will be removed in a future version and they should migrate to using host networking for CSI plugin pods. The warning is logged at the WARNING level when the feature is detected during volume staging/publishing operations. Also add deprecation notice to PendingReleaseNotes.md. Assisted-by: AskBob <askbob@ibm.com> Signed-off-by: Niels de Vos <ndevos@ibm.com>
nixpanic
force-pushed
the
deprecation/netNamespaceFilePath
branch
from
July 29, 2026 13:40
c16a5ba to
659bf3b
Compare
Member
Author
|
/test ci/centos/mini-e2e/k8s-1.37 |
Member
Author
Lots of tests have passed, except: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The feature is not commonly used. Rook and Ceph-CSI Operator have already
deprecated the feature and removed support for it.
Nodeplugins only have
hostPID: trueset because of this feature. By droppingthe feature, it is possible to reduce the permissions of the Nodeplugin a
little more.
Updates: #6415