csi-s3-archiver on Talos Linux

One label, and no machine configuration#

Talos turns Pod Security Admission on by default and enforces the baseline profile in every namespace except kube-system. baseline forbids hostPath volumes, and this driver mounts three of them, so the DaemonSet is rejected. That is the whole of the Talos difference. The driver itself needs nothing special from the operating system.

What the rejection looks like#

It is rejected by the DaemonSet controller, so no failing pod appears for you to describe, and kubectl get pods in the namespace shows nothing at all. The message is on the DaemonSet:

Warning  FailedCreate  16s  daemonset-controller  Error creating: pods "csi-s3-archiver-g9dh8" is
forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volumes "plugin-dir",
"registration-dir", "kubelet-pods-dir")

The same thing happens on any cluster that enforces baseline or restricted by default, whether through Talos's admission configuration, a cluster-wide default in the API server, or a policy engine applying the standards. Talos is simply the distribution where it is the default rather than a decision someone made.

The fix#

kubectl apply -k deploy/base is unaffected: The namespace in the kustomize base already carries the privileged labels, and the driver is in a namespace of its own precisely so that they apply to nothing else. Helm is affected: The chart does not template the namespace, and --create-namespace makes an unlabelled one. Create it yourself first:

# kubectl apply -k deploy/base already carries these labels. Helm does not create the
# namespace itself, and --create-namespace makes a bare one, so make it yourself first.
$ kubectl create namespace csi-s3-archiver
$ kubectl label namespace csi-s3-archiver \
    pod-security.kubernetes.io/enforce=privileged \
    pod-security.kubernetes.io/audit=privileged \
    pod-security.kubernetes.io/warn=privileged

$ helm install csi-s3-archiver deploy/helm/csi-s3-archiver -n csi-s3-archiver

Other distributions#

The install page has the overview. The rest of the awkward ones:

• vcluster. Install once on the host cluster. Volumes work from inside untouched, but every prefix placeholder resolves to the synced pod's host identity.
• OpenShift. hostmount-anyuid rather than privileged. The driver mounts host directories and runs as root, but it is not a privileged container.
• MicroK8s. Everything works once the three host paths point at /var/snap/microk8s/common/var/lib/kubelet.
• k0s. Point the driver at the k0s path, or point k0s back at the standard one and never think about it again.
• GKE Autopilot and EKS Fargate. Both rule the driver out by design. What to do instead, and why a mixed cluster is still fine.