Disable host network for the CSI node plugin

By default, the PX-CSI node plugin DaemonSet (px-pure-csi-node) runs with hostNetwork: true, which gives it access to host network interfaces. You can disable host networking to satisfy security policies that require pods to operate within the pod network namespace.

Prerequisites

Before you disable host networking, make sure you are running:

• PX-CSI version 26.2.1 or later.
• Portworx Operator version 25.3.0 or later.

Disable host network

To disable host networking for the CSI node plugin, add the portworx.io/disable-csi-host-network annotation to your StorageCluster resource:

1. Edit the StorageCluster resource:

   kubectl edit storagecluster -n portworx

2. Add the annotation under metadata.annotations:

   apiVersion: core.libopenstorage.org/v1
   kind: StorageCluster
   metadata:
     name: px-cluster
     namespace: portworx
     annotations:
       portworx.io/disable-csi-host-network: "true"

3. Save the changes. The px-pure-csi-node DaemonSet restarts automatically with hostNetwork: false.

Verify if host network is disabled

Confirm that the DaemonSet is no longer using host networking:

kubectl get daemonset px-pure-csi-node -n portworx -o jsonpath='{.spec.template.spec.hostNetwork}'

The command returns false when host networking is disabled.

Re-enable host network

To restore the default behavior:

1. Edit the StorageCluster resource:

   kubectl edit storagecluster -n portworx

2. Remove the portworx.io/disable-csi-host-network annotation, or set its value to "false".

3. Save the changes.

The px-pure-csi-node DaemonSet restarts with hostNetwork: true.