Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SECURITY] sidecar security context config #347

Closed
isaaccarrington opened this issue Oct 2, 2020 · 6 comments
Closed

[SECURITY] sidecar security context config #347

isaaccarrington opened this issue Oct 2, 2020 · 6 comments
Labels
area/connect Related to Connect service mesh, e.g. injection type/enhancement New feature or request

Comments

@isaaccarrington
Copy link

Containers in my Kubenernetes environment must not run as root and need runAsUser set for the security context.
e.g
securityContext: runAsUser: 1000

Is this possible? Can it be made possible?
@lkysow
Copy link
Member

lkysow commented Oct 2, 2020

Hi, is this specifically for the injected sidecars when using service mesh?

@isaaccarrington
Copy link
Author

Hey @lkysow, yeah that is exactly it

@lkysow lkysow added type/enhancement New feature or request area/connect Related to Connect service mesh, e.g. injection labels Oct 2, 2020
@isaaccarrington
Copy link
Author

isaaccarrington commented Oct 3, 2020 •
edited
Loading

I have Consul Connect version 1.8.4 and k8s version 0.18.1
The error message is
Normal Pulled 23s (x3 over 25s) kubelet, #######.co.nz Successfully pulled image "docker.artifactory2.#######.co.nz/consul:1.8.4" Warning Failed 23s (x3 over 25s) kubelet, #########.co.nz Error: container has runAsNonRoot and image will run as root

@isaaccarrington
Copy link
Author

I've updated the container securitycontexts and actually got this working. I'll rework it so that it is configurable via helm and has a default, then submit a PR

@isaaccarrington
Copy link
Author

Sorry I havn't forgotten. Hopefully get around to the PR this side of Christmas

This was referenced Nov 20, 2020
Closed
Open
@david-yu
Copy link
Contributor

Closing as this is addressed via #493

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/connect Related to Connect service mesh, e.g. injection type/enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@david-yu @lkysow @isaaccarrington