chore: update go dependencies and docs (#35)

* chore: don't cache apk packages

* chore: bump go dependencies

* chore: bump app version to 2.6.1 and chart to 1.5.1

* fix: remove runAsNonRoot config default which doesn't belong

* fox: update test and chart changelog

Author: aardbol

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.6.1] - 2026-06-21
+
+### Changed
+- build: optimize Containerfile — `--no-cache` on apk, remove redundant packages, Go 1.26 dependency consistency
+- docs: update README
+
 ## [2.6.0] - 2026-06-20
 
 ### Added

README.md

@@ -21,6 +21,10 @@ Full-featured Helm chart, published as an OCI artifact to `ghcr.io/upcloud-tools
 - Node DaemonSet with node-driver-registrar
 - Snapshot controller (2 replicas, leader election) and optional validation webhook
 - StorageClasses for all three UpCloud tiers: `maxiops`, `standard`, `hdd`
+- `securityContext` and `podSecurityContext` per component with secure defaults
+- `metrics` block — ClusterIP metrics Service, optional ServiceMonitor and PrometheusRule for prometheus-operator
+- `extraObjects` — deploy arbitrary Kubernetes resources with Go template support
+- Configurable pod spec fields
 - PodDisruptionBudget support for controller and snapshot-controller
 - Credential checksum annotation for automatic pod rollout on secret changes
 
@@ -54,7 +58,6 @@ This repository uses the following security and supply-chain measures:
 - **Branch protection** — `main` requires passing status checks (`golangci-lint`, `helm-lint`, `test`, CodeQL) and pull request review before merge.
 - **Action pinning** — All GitHub Actions pinned by commit SHA with a human-readable version comment; enforced globally.
 - **Static analysis** — `golangci-lint` with 50+ linters (`gosec`, `staticcheck`, `errcheck`, etc.) runs on every PR.
-- **Container image** — Distroless-inspired Alpine runtime, multistage build, pinned base image versions.
 - **Container scanning (Trivy)** — `aquasecurity/trivy-action` scans the built image for OS and application CVEs before push to GHCR; scheduled weekly rescan catches newly discovered vulnerabilities. Go module dependencies also scanned on every push/PR.
 - **Release integrity** — Helm chart validates that `appVersion` matches the git tag and that the container image exists before publishing.
 - **Artifact Hub** — Helm chart metadata published to Artifact Hub for discoverability.
@@ -85,36 +88,27 @@ kubectl delete crd volumesnapshotclasses.snapshot.storage.k8s.io \
                    volumesnapshots.snapshot.storage.k8s.io
 ```
 
-Or keep the existing CRDs and install with `--skip-crds`:
+Or keep the existing CRDs and install with `--skip-crds` (not recommended).
 
 ### Helm chart (install/upgrade)
 
-If the `upcloud` secret already exists in the namespace, omit the credentials (default behavior):
+UpCloud Kubernetes clusters ship with an `upcloud` secret in `kube-system` by default. If the secret exists, just install:
 
 ```shell
 helm upgrade --install upcloud-csi oci://ghcr.io/upcloud-tools/charts/upcloud-csi \
-  --namespace kube-system --version 1.2.0
+  --namespace kube-system --version 1.5.1
 ```
 
-Or specify credentials to create the secret (prepend with a space to avoid saving to shell history):
-
-```shell
-helm upgrade --install upcloud-csi oci://ghcr.io/upcloud-tools/charts/upcloud-csi \
-  --namespace kube-system --version 1.2.0 \
-  --set credentials.createSecret=true \
-  --set credentials.username=YOUR_USERNAME \
-  --set credentials.password=YOUR_PASSWORD
-```
-
-By default, StorageClasses are **disabled**. Enable them with `--set storageClasses.enabled=true` if you want the chart to manage them.
+To have the chart create the secret instead, set `credentials.createSecret=true` and provide the credentials.
+By default, StorageClasses are **disabled**. Enable them with `--set storageClasses.enabled=true`.
 
 All values have sensible defaults. See [values.yaml](deploy/helm/values.yaml) for the full reference.
 
 To customize, create a values file and pass it with `--values`:
 
 ```shell
 helm upgrade --install upcloud-csi oci://ghcr.io/upcloud-tools/charts/upcloud-csi \
-  --namespace kube-system --version 1.2.0 --values values.yaml
+  --namespace kube-system --version 1.5.1 --values values.yaml
 ```
 
 ## Credits

cmd/upcloud-csi-plugin/Containerfile

@@ -19,17 +19,16 @@ FROM alpine:3.23
 LABEL org.opencontainers.image.source=https://github.com/upcloud-tools/upcloud-csi \
       org.opencontainers.image.description="UpCloud CSI Driver"
 
-RUN apk add ca-certificates \
+RUN apk add --no-cache \
+    ca-certificates \
     cloud-utils-growpart \
     e2fsprogs \
-    eudev \
-    findmnt \
-    xfsprogs \
-    xfsprogs-extra \
-    blkid \
     e2fsprogs-extra \
+    eudev \
+    parted \
     util-linux \
-    parted
+    xfsprogs \
+    xfsprogs-extra
 
 COPY --from=build /workspace/upcloud-csi-plugin /bin/
 

deploy/helm/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Helm chart changelog
 
+## [1.5.1] - 2026-06-20
+
+### Changed
+- App version bumped to `v2.6.1`
+- Containerfile optimized — smaller runtime image
+
+### Fixed
+- Remove `runAsNonRoot` from controller, snapshot-controller, and webhook `podSecurityContext` defaults — CSI sidecar images run as root and cannot be launched with this constraint
+
 ## [1.5.0] - 2026-06-20
 
 ### Changed

deploy/helm/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: upcloud-csi
 description: CSI driver for UpCloud block storage
 type: application
-version: "1.5.0"
-appVersion: "v2.6.0"
+version: "1.5.1"
+appVersion: "v2.6.1"
 kubeVersion: ">=1.21.0"
 keywords:
   - csi
@@ -25,6 +25,5 @@ annotations:
     - name: Support
       url: https://github.com/upcloud-tools/upcloud-csi/issues
   artifacthub.io/changes: |
-    - "Add metrics Service, ServiceMonitor, and PrometheusRule support"
-    - "Driver plugin exposes Prometheus metrics via --metrics-address flag"
-    - "Driver metrics port on controller and node, wired into Service and ServiceMonitor"
+    - "App version bumped to v2.6.1"
+    - "Containerfile optimized — smaller runtime image"

deploy/helm/tests/security-context_test.yaml

@@ -3,12 +3,11 @@ tests:
   - it: should render default podSecurityContext on controller
     template: controller-statefulset.yaml
     asserts:
-      - equal:
-          path: spec.template.spec.securityContext.runAsNonRoot
-          value: true
       - equal:
           path: spec.template.spec.securityContext.seccompProfile.type
           value: RuntimeDefault
+      - notExists:
+          path: spec.template.spec.securityContext.runAsNonRoot
 
   - it: should render default container securityContext on all controller containers
     template: controller-statefulset.yaml
@@ -66,12 +65,11 @@ tests:
   - it: should render default podSecurityContext on snapshot controller
     template: snapshot-controller-deployment.yaml
     asserts:
-      - equal:
-          path: spec.template.spec.securityContext.runAsNonRoot
-          value: true
       - equal:
           path: spec.template.spec.securityContext.seccompProfile.type
           value: RuntimeDefault
+      - notExists:
+          path: spec.template.spec.securityContext.runAsNonRoot
 
   - it: should render default container securityContext on snapshot controller
     template: snapshot-controller-deployment.yaml
@@ -93,12 +91,11 @@ tests:
     template: snapshot-webhook.yaml
     documentIndex: 2
     asserts:
-      - equal:
-          path: spec.template.spec.securityContext.runAsNonRoot
-          value: true
       - equal:
           path: spec.template.spec.securityContext.seccompProfile.type
           value: RuntimeDefault
+      - notExists:
+          path: spec.template.spec.securityContext.runAsNonRoot
 
   - it: should render default container securityContext on webhook
     set:

deploy/helm/values.yaml

@@ -118,7 +118,6 @@ controller:  # @schema additionalProperties: false
     readOnlyRootFilesystem: true
   # -- Pod-level security context for controller pods.
   podSecurityContext:  # @schema additionalProperties: false
-    runAsNonRoot: true
     seccompProfile:
       type: RuntimeDefault
 
@@ -237,7 +236,6 @@ snapshotController:  # @schema additionalProperties: false
     readOnlyRootFilesystem: true
   # -- Pod-level security context for snapshot controller pods.
   podSecurityContext:  # @schema additionalProperties: false
-    runAsNonRoot: true
     seccompProfile:
       type: RuntimeDefault
   # -- Extra labels for the snapshot controller pod template.
@@ -306,7 +304,6 @@ snapshotValidationWebhook:  # @schema additionalProperties: false
     readOnlyRootFilesystem: true
   # -- Pod-level security context for webhook pods.
   podSecurityContext:  # @schema additionalProperties: false
-    runAsNonRoot: true
     seccompProfile:
       type: RuntimeDefault
   # -- Extra labels for the snapshot validation webhook pod template.

go.mod

@@ -1,76 +1,80 @@
 module github.com/upcloud-tools/upcloud-csi
 
-go 1.24.13
+go 1.26
 
 require (
 	github.com/container-storage-interface/spec v1.6.0
 	github.com/golang/protobuf v1.5.4
 	github.com/google/uuid v1.6.0
-	github.com/onsi/ginkgo/v2 v2.9.2
-	github.com/onsi/gomega v1.27.5
-	github.com/sirupsen/logrus v1.8.3
-	github.com/spf13/pflag v1.0.5
+	github.com/onsi/ginkgo/v2 v2.27.2
+	github.com/onsi/gomega v1.38.2
+	github.com/sirupsen/logrus v1.9.4
+	github.com/spf13/pflag v1.0.9
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/sync v0.19.0
-	golang.org/x/sys v0.39.0
-	google.golang.org/grpc v1.79.3
-	google.golang.org/protobuf v1.36.10
-	k8s.io/api v0.26.1
-	k8s.io/apimachinery v0.26.1
-	k8s.io/client-go v0.26.1
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
+	google.golang.org/grpc v1.81.1
+	google.golang.org/protobuf v1.36.11
+	k8s.io/api v0.35.6
+	k8s.io/apimachinery v0.35.6
+	k8s.io/client-go v0.35.6
 )
 
 require github.com/kubernetes-csi/csi-test/v5 v5.0.0
 
 require (
-	github.com/UpCloudLtd/upcloud-go-api/v8 v8.36.1
+	github.com/UpCloudLtd/upcloud-go-api/v8 v8.38.0
 	github.com/prometheus/client_golang v1.23.2
 )
 
 require (
-	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
-	github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 )
 
 require (
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gnostic v0.6.9 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/term v0.38.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/klog/v2 v2.80.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
-	k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect
-	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )