From b8ad8289a82752b4031a49b3f02c01bb939fa158 Mon Sep 17 00:00:00 2001 From: MohammadReza Date: Fri, 18 Sep 2026 13:50:44 +0330 Subject: [PATCH] Bump local-path-provisioner to v0.0.37 (#13525) * chore(deps): bump local-path-provisioner to v0.0.37 Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod template injection issue fixed in v0.0.36, where a user able to edit the local-path-config ConfigMap could cause unsafe HelperPods to be created. v0.0.36 adds template validation for this; Kubespray's helperPod template already passes it (no privileged containers, hostPath volumes or unsafe pod security settings). Also syncs two gaps in the vendored manifests, verified against upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml: - ClusterRole: grant update on persistentvolumeclaims (rancher/ local-path-provisioner#530) and read access to pods/log, which the provisioner needs to read helper pod output. Note the existing pods: ["*"] rule does not cover the pods/log subresource. - helperPod: add priorityClassName system-node-critical and a toleration for node.kubernetes.io/disk-pressure, so cleanup pods can still be scheduled onto a node that is under disk pressure. * fix(local-path-provisioner): add health probes and config env vars --- README.md | 2 +- .../templates/local-path-storage-cm.yml.j2 | 5 ++++ .../templates/local-path-storage-cr.yml.j2 | 5 +++- .../local-path-storage-deployment.yml.j2 | 27 +++++++++++++++++++ .../defaults/main/download.yml | 2 +- 5 files changed, 38 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c706ab585..94d88767e 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ Note: - [azure-csi-plugin](https://github.com/kubernetes-sigs/azuredisk-csi-driver) 1.10.0 - [cinder-csi-plugin](https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/cinder-csi-plugin/using-cinder-csi-plugin.md) 1.30.0 - [gcp-pd-csi-plugin](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver) 1.9.2 - - [local-path-provisioner](https://github.com/rancher/local-path-provisioner) 0.0.32 + - [local-path-provisioner](https://github.com/rancher/local-path-provisioner) 0.0.37 - [local-volume-provisioner](https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner) 2.5.0 - [node-feature-discovery](https://github.com/kubernetes-sigs/node-feature-discovery) 0.19.0 diff --git a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cm.yml.j2 b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cm.yml.j2 index a0b0bc123..729ff11c6 100644 --- a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cm.yml.j2 +++ b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cm.yml.j2 @@ -28,6 +28,11 @@ data: metadata: name: helper-pod spec: + priorityClassName: system-node-critical + tolerations: + - key: node.kubernetes.io/disk-pressure + operator: Exists + effect: NoSchedule containers: - name: helper-pod image: "{{ local_path_provisioner_helper_image_repo }}:{{ local_path_provisioner_helper_image_tag }}" diff --git a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cr.yml.j2 b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cr.yml.j2 index 2b53ba72d..cdaeaf4fc 100644 --- a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cr.yml.j2 +++ b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-cr.yml.j2 @@ -5,8 +5,11 @@ metadata: name: local-path-provisioner-role rules: - apiGroups: [ "" ] - resources: [ "nodes", "persistentvolumeclaims", "configmaps" ] + resources: [ "nodes", "configmaps", "pods/log" ] verbs: [ "get", "list", "watch" ] + - apiGroups: [ "" ] + resources: [ "persistentvolumeclaims" ] + verbs: [ "get", "list", "watch", "update" ] - apiGroups: [ "" ] resources: [ "endpoints", "persistentvolumes", "pods" ] verbs: [ "*" ] diff --git a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2 b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2 index fce2828d9..2ac589274 100644 --- a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2 +++ b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2 @@ -27,6 +27,29 @@ spec: {% if local_path_provisioner_debug %} - --debug {% endif %} + ports: + - name: health + containerPort: 8080 + protocol: TCP + startupProbe: + httpGet: + path: /health + port: health + initialDelaySeconds: 5 + periodSeconds: 5 + failureThreshold: 12 + livenessProbe: + httpGet: + path: /health + port: health + initialDelaySeconds: 10 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /ready + port: health + initialDelaySeconds: 5 + periodSeconds: 5 volumeMounts: - name: config-volume mountPath: /etc/config/ @@ -35,6 +58,10 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace + - name: CONFIG_MOUNT_PATH + value: /etc/config/ + - name: HEALTH_PORT + value: "8080" {% if local_path_provisioner_resources %} resources: {{ local_path_provisioner_resources | to_nice_yaml | indent(10) | trim }} diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index 91c12c5fb..da6027a62 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -299,7 +299,7 @@ metrics_server_image_tag: "v{{ metrics_server_version }}" local_volume_provisioner_version: "2.5.0" local_volume_provisioner_image_repo: "{{ kube_image_repo }}/sig-storage/local-volume-provisioner" local_volume_provisioner_image_tag: "v{{ local_volume_provisioner_version }}" -local_path_provisioner_version: "0.0.32" +local_path_provisioner_version: "0.0.37" local_path_provisioner_image_repo: "{{ docker_image_repo }}/rancher/local-path-provisioner" local_path_provisioner_image_tag: "v{{ local_path_provisioner_version }}" alb_ingress_image_repo: "{{ docker_image_repo }}/amazon/aws-alb-ingress-controller"