The CSI provider currently still needs to run as root because it creates openbao.sock in the shared providers hostPath: /etc/kubernetes/secrets-store-csi-providers.
When testing runAsNonRoot: true, the DaemonSet fails to bind the provider socket with a permission error. The rest of the low-hanging hardening works (see #134), but non-root needs separate ownership/permission handling as mentioned in #133.
We should investigate a clean approach for non-root support, likely around provider socket directory ownership. This needs to account for compatibility with other Secrets Store CSI providers, since the provider directory can be shared on the node.
Potential scope:
- define the expected UID/GID for the provider
- handle hostPath/socket ownership safely
- avoid breaking co-installed providers
- document any compatibility assumptions/tradeoffs
The CSI provider currently still needs to run as root because it creates
openbao.sockin the shared providers hostPath:/etc/kubernetes/secrets-store-csi-providers.When testing runAsNonRoot: true, the DaemonSet fails to bind the provider socket with a permission error. The rest of the low-hanging hardening works (see #134), but non-root needs separate ownership/permission handling as mentioned in #133.
We should investigate a clean approach for non-root support, likely around provider socket directory ownership. This needs to account for compatibility with other Secrets Store CSI providers, since the provider directory can be shared on the node.
Potential scope: