Install

csi-s3-archiver on OpenShift

hostPath volumes and uid 0, granted by hostmount-anyuid. The driver is not a privileged container and does not ask to become one.

One SecurityContextConstraint#

OpenShift admits pods through SecurityContextConstraints as well as Pod Security. The driver's ServiceAccount needs one that allows hostPath volumes and uid 0; the default restricted-v2 allows neither, so without this the DaemonSet's pods are refused at admission.

grant the node plugin its two exceptions

# hostmount-anyuid, not privileged. It grants exactly the two things the DaemonSet needs,
# hostPath volumes and running as uid 0, and nothing else. The driver is not a privileged
# container and does not want to become one.
$ oc adm policy add-scc-to-user hostmount-anyuid \
    -z csi-s3-archiver -n csi-s3-archiver

# With the optional Controller, its ServiceAccount needs nothing extra: it mounts no host path.
$ oc -n csi-s3-archiver get pods

Why not the privileged SCC#

It is worth being precise about what is being granted, because "CSI driver" and "privileged" usually arrive together and here they do not.

What the DaemonSet asks for	Which SCC covers it
Three hostPath volumes under `/var/lib/kubelet`	`allowHostDirVolumePlugin`, in `hostmount-anyuid`
`runAsUser: 0`	`RunAsAny`, in `hostmount-anyuid`
`privileged: true`	Not asked for
Added capabilities	None. The container drops `ALL`
Host network, host PID, host IPC	None of them
Bidirectional mount propagation	Not asked for; the driver makes no `mount(2)` call

A CSI volume here is a plain directory the node plugin creates, not a mount, which is what lets the whole thing stay this narrow. hostmount-anyuid grants exactly the two rows that are needed, and the privileged SCC grants a great deal more than the job requires.

Other distributions#

The install page has the overview. The rest of the awkward ones:

vcluster. Install once on the host cluster. Volumes work from inside untouched, but every prefix placeholder resolves to the synced pod's host identity.
Talos Linux. The kustomize base already labels its namespace; Helm does not. No kubelet extra mounts are needed.
MicroK8s. Everything works once the three host paths point at /var/snap/microk8s/common/var/lib/kubelet.
k0s. Point the driver at the k0s path, or point k0s back at the standard one and never think about it again.
GKE Autopilot and EKS Fargate. Both rule the driver out by design. What to do instead, and why a mixed cluster is still fine.