How to set label pod-security.kubernetes.io/enforce to baseline

[1happybot]

Hi,
I would like to set a label on the namespace mount-s3 created in EKS by the mountpoint-s3-csi-driver to

pod-security.kubernetes.io/enforce=baseline

Is there any way available to configure mount-s3 namespace created by mountpoint-s3-csi-driver

Environment:
EKS Auto v1.33
Mountpoint-s3-csi-driver v2.1.0-eksbuild.1

[andreas-aman]

Reason is that without changing the pod-security level the controller is throwing these errors.

pods \"mp-zdtd8\" is forbidden: violates PodSecurity \"restricted:latest\": seccompProfile (pod or container \"dynatrace-operator\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")

[yerzhan7]

Mountpoint Pods are always created with RuntimeDefault. See https://github.com/awslabs/mountpoint-s3-csi-driver/blob/main/pkg/podmounter/mppod/creator.go#L141

So, I am not sure why you are seeing this error. What is dynatrace-operator?

FYI: You might be able to create your own MP Pod namespace (with the label your prefer) after this PR is merged: #580

[dannycjones]

Is it fair to say that the dynatrace-operator may be mutating the Mountpoint pods spec? @andreas-aman

If so, then it may be reasonable for us to focus on allowing you to configure your own namespace as Yerzhan suggests. However, we don't currently have plans to allow that configuration on the EKS add-on.

[dannycjones]

@1happybot are you working with @andreas-aman? I'm trying to understand if there are two separate use cases or not.