fix(security): switch node daemonset to --mode=node (#49)

* fix(security): switch node daemonset to --mode=node

* fix(helm): add node.zone Helm value with fallback to controller.zone

* fix: controller doesn't need mode helm value

* chore(helm): add global clusterZone value

* chore(ci): move cert-manager install to makefile

* chore(test): move e2e ClusterIssuer manifest to separate file

Author: aardbol

.github/workflows/_reusable-e2e.yaml

@@ -49,27 +49,6 @@ jobs:
         with:
           version: 1.36.2
 
-      - name: Install cert-manager
-        run: |
-          helm repo add jetstack https://charts.jetstack.io
-          helm upgrade --install cert-manager jetstack/cert-manager \
-            --namespace cert-manager --create-namespace \
-            --version v1.20.3 \
-            --set crds.enabled=true
-          kubectl wait --namespace cert-manager --for=condition=Available deployment cert-manager --timeout=180s
-          kubectl wait --namespace cert-manager --for=condition=Available deployment cert-manager-webhook --timeout=180s
-
-      - name: Create e2e ClusterIssuer for webhook test
-        run: |
-          kubectl apply -f - <<EOF
-          apiVersion: cert-manager.io/v1
-          kind: ClusterIssuer
-          metadata:
-            name: e2e-selfsigned
-          spec:
-            selfSigned: {}
-          EOF
-
       - name: Deploy CSI driver via Helm
         run: |
           make deploy-test \

Makefile

@@ -26,10 +26,27 @@ helm-deploy:
 		$(if $(HELM_VALUES),--values $(HELM_VALUES),) \
 		$(HELM_OPTS) --wait --timeout 180s
 
+CERT_MANAGER_VERSION ?= v1.20.3
+
+.PHONY: install-cert-manager
+install-cert-manager:
+	helm repo add jetstack https://charts.jetstack.io
+	helm upgrade --install cert-manager jetstack/cert-manager \
+		--namespace cert-manager --create-namespace \
+		--version $(CERT_MANAGER_VERSION) \
+		--set crds.enabled=true
+	kubectl wait --namespace cert-manager --for=condition=Available deployment cert-manager --timeout=180s
+	kubectl wait --namespace cert-manager --for=condition=Available deployment cert-manager-webhook --timeout=180s
+
+.PHONY: create-e2e-clusterissuer
+create-e2e-clusterissuer:
+	kubectl apply -f test/e2e/clusterissuer.yaml
+
 .PHONY: deploy-test
-deploy-test:
+deploy-test: install-cert-manager create-e2e-clusterissuer
 	helm upgrade --install upcloud-csi $(HELM_CHART_DIR) --namespace kube-system \
 		--set networkPolicy.enabled=true \
+		--set clusterZone=de-fra1 \
 		$(if $(HELM_VALUES),--values $(HELM_VALUES),) \
 		$(HELM_OPTS) --wait --timeout 180s
 

deploy/helm/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Helm chart changelog
 
+## [1.11.0] - 2026-06-30
+
+### Added
+- `clusterZone` value for both controller and node. Setting it avoids an API call on the controller startup, since it's needed for the DaemonSet already.
+
+### Changed
+- Node DaemonSet runs `--mode=node` now instead of `--mode=monolith`. UpCloud API credentials are no longer deployed to every cluster node, reducing credential blast radius
+- Controller StatefulSet and Node DaemonSet use `clusterZone` for the `--zone` flag
+
 ## [1.10.0] - 2026-06-28
 
 ### Added

deploy/helm/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: upcloud-csi
 description: CSI driver for UpCloud block storage
 type: application
-version: "1.10.0"
+version: "1.11.0"
 appVersion: "v2.8.3"
 kubeVersion: ">=1.21.0"
 keywords:
@@ -25,4 +25,5 @@ annotations:
     - name: Support
       url: https://github.com/upcloud-tools/upcloud-csi/issues
   artifacthub.io/changes: |
-    - "Chart packages are signed too now"
+    - "Node DaemonSet switches to --mode=node — credentials no longer deployed to every node"
+    - "Add root-level clusterZone for both controller and node"

deploy/helm/templates/controller-statefulset.yaml

@@ -214,7 +214,7 @@ spec:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--nodehost=$(NODE_ID)"
             - "--mode=monolith"
-            {{- with .Values.controller.zone }}
+            {{- with .Values.clusterZone }}
             - "--zone={{ . }}"
             {{- end }}
             - "--address=tcp://0.0.0.0:13071"

deploy/helm/templates/node-daemonset.yaml

@@ -30,7 +30,6 @@ spec:
 {{ tpl (toYaml .) $ | indent 8 }}
 {{- end }}
       annotations:
-        checksum/credentials: {{ include "upcloud-csi.credentialsChecksum" . | quote }}
 {{- with .Values.node.podAnnotations }}
 {{ tpl (toYaml .) $ | indent 8 }}
 {{- end }}
@@ -119,8 +118,8 @@ spec:
           args:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--nodehost=$(NODE_ID)"
-            - "--mode=monolith"
-            {{- with .Values.controller.zone }}
+            - "--mode=node"
+            {{- with .Values.clusterZone }}
             - "--zone={{ . }}"
             {{- end }}
             - "--address=tcp://0.0.0.0:13071"
@@ -130,24 +129,6 @@ spec:
           env:
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
-            - name: UPCLOUD_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "upcloud-csi.credentialsSecret" . }}
-                  key: username
-                  optional: true
-            - name: UPCLOUD_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "upcloud-csi.credentialsSecret" . }}
-                  key: password
-                  optional: true
-            - name: UPCLOUD_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "upcloud-csi.credentialsSecret" . }}
-                  key: {{ .Values.credentials.tokenKey }}
-                  optional: true
             - name: NODE_ID
               valueFrom:
                 fieldRef:

deploy/helm/tests/credentials_test.yaml

@@ -87,28 +87,3 @@ tests:
           path: spec.template.spec.containers[4].env[3].valueFrom.secretKeyRef.key
           value: my-token
 
-  - it: node should have UPCLOUD_TOKEN env var
-    template: node-daemonset.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[1].env[3].name
-          value: UPCLOUD_TOKEN
-      - equal:
-          path: spec.template.spec.containers[1].env[3].valueFrom.secretKeyRef.key
-          value: token
-      - equal:
-          path: spec.template.spec.containers[1].env[3].valueFrom.secretKeyRef.name
-          value: upcloud
-
-  - it: node UPCLOUD_TOKEN should use custom tokenKey
-    set:
-      credentials:
-        tokenKey: my-token
-    template: node-daemonset.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[1].env[3].name
-          value: UPCLOUD_TOKEN
-      - equal:
-          path: spec.template.spec.containers[1].env[3].valueFrom.secretKeyRef.key
-          value: my-token

deploy/helm/values.yaml

@@ -7,6 +7,10 @@ fullnameOverride: ""
 # -- Common labels added to all resources.
 commonLabels: {}
 
+# -- UpCloud zone (e.g. de-fra1). Passed to both controller and node pods.
+# The controller discovers it automatically if empty.
+clusterZone: ""  # @schema type:string
+
 # -- Default log verbosity, overridable per component.
 logLevel: 5
 
@@ -37,8 +41,6 @@ image:  # @schema additionalProperties: false
 
 # Controller StatefulSet settings.
 controller:  # @schema additionalProperties: false
-  # -- UpCloud zone (e.g. de-fra1). Auto-detected from node hostname if empty.
-  zone: ""  # @schema type:string
   # -- Log verbosity (inherits global logLevel when null).
   logLevel:  # @schema type:[integer, null]; minimum:0; maximum:10
 

test/e2e/clusterissuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: e2e-selfsigned
+spec:
+  selfSigned: {}