Use new restricted liveness probe endpoint

The `--health-port` option is deprecated and `--http-endpoint` the new
option to use. Since `--http-endpoint` additionally exposes metrics, the
liveness probe is limited to only listen on localhost by default. With
this only processes on the host network, like kubelet, can call the
endpoint. Regular pods can no longer access the liveness probe via the
node IP address.

Signed-off-by: Tobi Nehrlich <tobi.nehrlich@amazee.io>

charts/README.md

@@ -69,6 +69,8 @@ The following table lists the configurable parameters of the latest NFS CSI Driv
 | `controller.runOnControlPlane`                    | run controller on control plane node                                                          |`false`                                                           |
 | `controller.dnsPolicy`                            | dnsPolicy of controller driver, available values: `Default`, `ClusterFirstWithHostNet`, `ClusterFirst`                              | `ClusterFirstWithHostNet`                                                             |
 | `controller.defaultOnDeletePolicy`                | default policy for deleting subdirectory when deleting a volume, available values: `delete`, `retain`, `archive`                              | `delete`                                                             |
+| `controller.livenessProbe.host ` | the health check host for the liveness probe | `localhost` |
+| `controller.livenessProbe.healthPort ` | the health check port for liveness probe | `29652` |
 | `controller.logLevel`                             | controller driver log level                                                          |`5`                                                           |
 | `controller.workingMountDir`                      | working directory for provisioner to mount nfs shares temporarily                  | `/tmp`                                                             |
 | `controller.affinity`                                 | controller pod affinity                               | `{}`                                                             |
@@ -88,6 +90,7 @@ The following table lists the configurable parameters of the latest NFS CSI Driv
 | `node.dnsPolicy`                                      | dnsPolicy of driver node daemonset, available values: `Default`, `ClusterFirstWithHostNet`, `ClusterFirst`          |`ClusterFirstWithHostNet`
 | `node.maxUnavailable`                             | `maxUnavailable` value of driver node daemonset                            | `1`
 | `node.logLevel`                                   | node driver log level                                                          |`5`                                                           |
+| `node.livenessProbe.host ` | the health check host for the liveness probe | `localhost` |
 | `node.livenessProbe.healthPort `                  | the health check port for liveness probe                    |`29653`                                                           |
 | `node.affinity`                                      | node pod affinity                                     | {}                                                             |
 | `node.nodeSelector`                                   | node pod node selector                                | `{}`                                                             |

charts/latest/csi-driver-nfs/templates/csi-nfs-controller.yaml

@@ -100,7 +100,7 @@ spec:
           args:
             - --csi-address=/csi/csi.sock
             - --probe-timeout=3s
-            - --health-port={{ .Values.controller.livenessProbe.healthPort }}
+            - --http-endpoint={{ .Values.controller.livenessProbe.host }}:{{ .Values.controller.livenessProbe.healthPort }}
             - --v=2
           imagePullPolicy: {{ .Values.image.livenessProbe.pullPolicy }}
           volumeMounts:
@@ -137,15 +137,12 @@ spec:
                   fieldPath: spec.nodeName
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
-          ports:
-            - containerPort: {{ .Values.controller.livenessProbe.healthPort }}
-              name: healthz
-              protocol: TCP
           livenessProbe:
             failureThreshold: 5
             httpGet:
+              host: {{ .Values.controller.livenessProbe.host }}
               path: /healthz
-              port: healthz
+              port: {{ .Values.controller.livenessProbe.healthPort }}
             initialDelaySeconds: 30
             timeoutSeconds: 10
             periodSeconds: 30

charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml

@@ -52,7 +52,7 @@ spec:
           args:
             - --csi-address=/csi/csi.sock
             - --probe-timeout=3s
-            - --health-port={{ .Values.node.livenessProbe.healthPort }}
+            - --http-endpoint={{ .Values.node.livenessProbe.host }}:{{ .Values.node.livenessProbe.healthPort }}
             - --v=2
           imagePullPolicy: {{ .Values.image.livenessProbe.pullPolicy }}
           volumeMounts:
@@ -118,15 +118,12 @@ spec:
                   fieldPath: spec.nodeName
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
-          ports:
-            - containerPort: {{ .Values.node.livenessProbe.healthPort }}
-              name: healthz
-              protocol: TCP
           livenessProbe:
             failureThreshold: 5
             httpGet:
+              host: {{ .Values.node.livenessProbe.host }}
               path: /healthz
-              port: healthz
+              port: {{ .Values.node.livenessProbe.healthPort }}
             initialDelaySeconds: 30
             timeoutSeconds: 10
             periodSeconds: 30

charts/latest/csi-driver-nfs/values.yaml

@@ -53,6 +53,7 @@ controller:
   runOnMaster: false
   runOnControlPlane: false
   livenessProbe:
+    host: localhost
     healthPort: 29652
   logLevel: 5
   workingMountDir: /tmp
@@ -103,6 +104,7 @@ node:
   maxUnavailable: 1
   logLevel: 5
   livenessProbe:
+    host: localhost
     healthPort: 29653
   affinity: {}
   nodeSelector: {}