Fix node.selinux configuration parameter & release Helm Chart v2.39.1

[AndrewSirenko]

What type of PR is this?

/kind bug

What is this PR about? / Why do we need it?

Fix node.selinux configuration parameter because Pod spec.volumes.hostpath does not have a readOnly. That belongs in pod.spec.containers.volumeMounts.

When you install via helm this readOnly is dropped with a warning. However this breaks add-on.

❯ helm upgrade --install aws-ebs-csi-driver \
    --namespace kube-system --set "node.selinux=true" \
    aws-ebs-csi-driver/aws-ebs-csi-driver
Release "aws-ebs-csi-driver" does not exist. Installing it now.
W0124 19:27:54.986662   29648 warnings.go:70] unknown field "spec.template.spec.volumes[4].hostPath.readOnly"
W0124 19:27:54.986683   29648 warnings.go:70] unknown field "spec.template.spec.volumes[5].hostPath.readOnly"

How was this change tested?

❯ helm template aws-ebs-csi-driver ./charts/aws-ebs-csi-driver > pre.yml
helm template aws-ebs-csi-driver ./charts/aws-ebs-csi-driver --set node.selinux=true > post.yml

diff pre.yml post.yml -C 5
*** pre.yml	2025-01-24 21:04:48.509855690 +0000
--- post.yml	2025-01-24 21:04:48.599854884 +0000
***************
*** 480,489 ****
--- 480,495 ----
                mountPropagation: "Bidirectional"
              - name: plugin-dir
                mountPath: /csi
              - name: device-dir
                mountPath: /dev
+             - name: selinux-sysfs
+               mountPath: /sys/fs/selinux
+               readOnly: true
+             - name: selinux-config
+               mountPath: /etc/selinux/config
+               readOnly: true
            ports:
              - name: healthz
                containerPort: 9808
                protocol: TCP
            livenessProbe:
***************
*** 576,585 ****
--- 582,599 ----
              type: Directory
          - name: device-dir
            hostPath:
              path: /dev
              type: Directory
+         - name: selinux-sysfs
+           hostPath:
+             path: /sys/fs/selinux
+             type: Directory
+         - name: selinux-config
+           hostPath:
+             path: /etc/selinux/config
+             type: File
          - name: probe-dir
            emptyDir: {}
  ---
  # Source: aws-ebs-csi-driver/templates/controller.yaml
  # Controller Service

❯ helm upgrade --install aws-ebs-csi-driver \
    --namespace kube-system --set "node.selinux=true" \
    charts/aws-ebs-csi-driver
Release "aws-ebs-csi-driver" does not exist. Installing it now.
NAME: aws-ebs-csi-driver
LAST DEPLOYED: Fri Jan 24 21:05:37 2025
NAMESPACE: kube-system
STATUS: deployed

❯ k get daemonset ebs-csi-node -o yaml -n kube-system | grep selinux -C 5
          name: kubelet-dir
        - mountPath: /csi
          name: plugin-dir
        - mountPath: /dev
          name: device-dir
        - mountPath: /sys/fs/selinux
          name: selinux-sysfs
          readOnly: true
        - mountPath: /etc/selinux/config
          name: selinux-config
          readOnly: true
      - args:
        - --csi-address=$(ADDRESS)
        - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
        - --v=2
--
      - hostPath:
          path: /dev
          type: Directory
        name: device-dir
      - hostPath:
          path: /sys/fs/selinux
          type: Directory
        name: selinux-sysfs
      - hostPath:
          path: /etc/selinux/config
          type: File
        name: selinux-config
      - emptyDir: {}
        name: probe-dir

Does this PR introduce a user-facing change?

NONE

[github-actions]

Code Coverage Diff

This PR does not change the code coverage

[AndrewSirenko]

note I will cherrypick to release-139 branch.

[torredil]

Validated the warnings are no longer present via helm upgrade --install aws-ebs-csi-driver --namespace kube-system ./charts/aws-ebs-csi-driver --values ./charts/aws-ebs-csi-driver/values.yaml --set node.selinux=true and that the values are rendered as expected:

kubectl describe pod ebs-csi-node-lfxl8 -n kube-system | grep "selinux-sysfs"                            
/sys/fs/selinux from selinux-sysfs (ro)

/lgtm
/approve
/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: torredil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [torredil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[AndrewSirenko]

/unhold

[AndrewSirenko]

/cherry-pick release-1.39

[torredil]

/lgtm
/approve