Is it feasible to restrict the permissions of Trident containers.?

Applies to

Astra Trident

Answer

Is it advaisable to adjust the permissions highlighted below.

    resourceNames:
      - trident-controller
      - trident-node-linux
      - trident-node-windows
      - trident-csi
      - trident
  - apiGroups:
      - authorization.openshift.io
      - rbac.authorization.k8s.io
    resources:
      - roles
      - rolebindings
      - clusterroles
      - clusterrolebindings
    verbs:
      - list
      - create
  - apiGroups:
      - authorization.openshift.io
      - rbac.authorization.k8s.io
    resources:
      - roles
      - rolebindings
      - clusterroles
      - clusterrolebindings
    verbs:
      - delete
      - update
      - patch
 

Ans. No. It's not advaisable modify the permissions for Trident containers.

Additional Information

Trident is a storage orchestrator for Kubernetes that integrates with various storage systems. The Trident containers are privileged containers for specific reasons related to their functionality and the requirements of the underlying storage systems. Here are a few reasons why Trident containers are privileged:
1.    Access to low-level storage operations: Trident interacts with the underlying storage systems and performs various operations, such as creating volumes, snapshots, and clones, and managing storage resources. To accomplish these tasks, Trident needs        privileged access to the host system to execute low-level storage operations that require elevated privileges.
2.    Access to device-specific APIs: Storage systems often expose device-specific APIs and interfaces that require privileged access to interact with. By running as a privileged container, Trident can utilize these APIs to communicate with the storage system and perform advanced operations that require direct interaction with the underlying storage hardware.
3.    Security and isolation: Trident operates and manages storage resources, which are critical components of an application's data. By running as a privileged container, Trident can enforce security measures and isolation to protect the storage system and prevent unauthorized access or tampering. Also Trident handles iscsi and nfs related tools which needs enhanced permissions.