[kubernetes] Set hostUsers explicitly #997
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds an explicit hostUsers: true setting to the PCM Kubernetes DaemonSet manifest to document the incompatibility with user namespaces and ensure the DaemonSet continues to function correctly if Kubernetes changes the default behavior for this field.
Key change:
- Adds
hostUsers: truefield to explicitly require host user namespace access for the PCM daemon
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The pcm daemons require host privileges. Setting this explicitly both documentes the incompatibility with user namespaces and ensures, if the default changes, the daemonset will continue to function as expected. Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| automountServiceAccountToken: false | ||
| hostUsers: true | ||
| containers: | ||
| - image: ghcr.io/intel/pcm:latest |
There was a problem hiding this comment.
The container image is referenced using the mutable :latest tag (image: ghcr.io/intel/pcm:latest), which creates a supply chain risk because new, potentially malicious image versions can be pulled without any change to this manifest. Since this DaemonSet has host-level access via SYS_ADMIN, SYS_RAWIO, and multiple hostPath mounts, a compromised or hijacked image tag here could lead to full node compromise across the cluster. Pin this dependency to an immutable, trusted identifier (for example a specific version tag or image digest) and update it deliberately through code review.
2 participants
The daemons require host privileges. Setting this explicitly both documentes the incompatibility with user namespaces and ensures, if the default changes, the daemonset will continue to function as expected.