Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Run istio-init with non-root UID #20380

Merged
merged 4 commits into from
Feb 3, 2020
Merged

Run istio-init with non-root UID #20380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a3ac701
Run istio-init with UID 1337
rlenglet Jan 21, 2020
a2c7942
Make make common-test pass
rlenglet Jan 21, 2020
5028987
Limit iptables-restore/save to only the tables used
rlenglet Jan 21, 2020
4a51bf7
Set the ambient capabilities for iptables commands
rlenglet Jan 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile.core.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ SHELL := /bin/bash -o pipefail
VERSION ?= 1.6-dev

# Base version of Istio image to use
BASE_VERSION ?= 1.6-dev.0
BASE_VERSION ?= 1.6-dev.1

export GO111MODULE ?= on
export GOPROXY ?= https://proxy.golang.org
Expand Down
1 change: 1 addition & 0 deletions docker/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ RUN apt-get update && \
iproute2 \
iputils-ping \
knot-dnsutils \
libcap2-bin \
netcat \
tcpdump \
net-tools \
Expand Down
10 changes: 2 additions & 8 deletions install/kubernetes/helm/istio/files/injection-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ initContainers:
{{- end }}
securityContext:
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
privileged: {{ .Values.global.proxy.privileged }}
capabilities:
{{- if not .Values.istio_cni.enabled }}
add:
Expand All @@ -59,16 +58,11 @@ initContainers:
{{- end }}
drop:
- ALL
privileged: {{ .Values.global.proxy.privileged }}
readOnlyRootFilesystem: false
{{- if not .Values.istio_cni.enabled }}
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
{{- else }}
runAsGroup: 1337
runAsUser: 1337
runAsNonRoot: true
{{- end }}
runAsUser: 1337
restartPolicy: Always
{{ end -}}
{{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/cronjob-with-app.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,9 +125,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
restartPolicy: OnFailure
volumes:
- emptyDir:
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/cronjob.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,9 +153,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
restartPolicy: OnFailure
volumes:
- emptyDir:
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/daemonset.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/deploymentconfig-multi.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,9 +177,9 @@ items:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/deploymentconfig.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,9 +162,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/enable-core-dump.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,9 +163,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
- args:
- -c
- sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/job.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,9 +151,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
restartPolicy: Never
volumes:
- emptyDir:
Expand Down
13 changes: 7 additions & 6 deletions istioctl/cmd/testdata/uninject/list.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,9 +172,9 @@ items:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- name: test
secret:
Expand Down Expand Up @@ -351,13 +351,14 @@ items:
capabilities:
add:
- NET_ADMIN
- NET_RAW
drop:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/pod.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,9 +151,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/replicaset.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,9 +159,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/replicationcontroller.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- emptyDir:
medium: Memory
Expand Down
6 changes: 3 additions & 3 deletions istioctl/cmd/testdata/uninject/statefulset.yaml.injected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,9 +167,9 @@ spec:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
runAsGroup: 1337
runAsNonRoot: true
runAsUser: 1337
volumes:
- hostPath:
path: /mnt/disks/ssd0
Expand Down
10 changes: 2 additions & 8 deletions manifests/istio-control/istio-autoinject/files/injection-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,6 @@ template: |
{{- end }}
securityContext:
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
privileged: {{ .Values.global.proxy.privileged }}
capabilities:
{{- if not .Values.istio_cni.enabled }}
add:
Expand All @@ -60,16 +59,11 @@ template: |
{{- end }}
drop:
- ALL
privileged: {{ .Values.global.proxy.privileged }}
rlenglet marked this conversation as resolved.
Show resolved Hide resolved
readOnlyRootFilesystem: false
{{- if not .Values.istio_cni.enabled }}
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
{{- else }}
runAsGroup: 1337
runAsUser: 1337
runAsNonRoot: true
{{- end }}
runAsUser: 1337
restartPolicy: Always
{{ end -}}
{{- if eq .Values.global.proxy.enableCoreDump true }}
Expand Down
10 changes: 2 additions & 8 deletions manifests/istio-control/istio-discovery/files/injection-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,6 @@ template: |
{{- end }}
securityContext:
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
privileged: {{ .Values.global.proxy.privileged }}
capabilities:
{{- if not .Values.istio_cni.enabled }}
add:
Expand All @@ -65,16 +64,11 @@ template: |
{{- end }}
drop:
- ALL
privileged: {{ .Values.global.proxy.privileged }}
readOnlyRootFilesystem: false
{{- if not .Values.istio_cni.enabled }}
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
{{- else }}
runAsGroup: 1337
runAsUser: 1337
runAsNonRoot: true
{{- end }}
runAsUser: 1337
restartPolicy: Always
{{ end -}}
{{- if eq .Values.global.proxy.enableCoreDump true }}
Expand Down
20 changes: 4 additions & 16 deletions ...tor/cmd/mesh/testdata/manifest-generate/output/all_on.golden-show-in-gh-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8873,7 +8873,6 @@ data:
{{- end }}
securityContext:
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
privileged: {{ .Values.global.proxy.privileged }}
capabilities:
{{- if not .Values.istio_cni.enabled }}
add:
Expand All @@ -8882,16 +8881,11 @@ data:
{{- end }}
drop:
- ALL
privileged: {{ .Values.global.proxy.privileged }}
readOnlyRootFilesystem: false
{{- if not .Values.istio_cni.enabled }}
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
{{- else }}
runAsGroup: 1337
runAsUser: 1337
runAsNonRoot: true
{{- end }}
runAsUser: 1337
restartPolicy: Always
{{ end -}}
{{- if eq .Values.global.proxy.enableCoreDump true }}
Expand Down Expand Up @@ -10787,7 +10781,6 @@ data:
{{- end }}
securityContext:
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
privileged: {{ .Values.global.proxy.privileged }}
capabilities:
{{- if not .Values.istio_cni.enabled }}
add:
Expand All @@ -10796,16 +10789,11 @@ data:
{{- end }}
drop:
- ALL
privileged: {{ .Values.global.proxy.privileged }}
readOnlyRootFilesystem: false
{{- if not .Values.istio_cni.enabled }}
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
{{- else }}
runAsGroup: 1337
runAsUser: 1337
runAsNonRoot: true
{{- end }}
runAsUser: 1337
restartPolicy: Always
{{ end -}}
{{- if eq .Values.global.proxy.enableCoreDump true }}
Expand Down
10 changes: 2 additions & 8 deletions operator/cmd/mesh/testdata/manifest-generate/output/component_hub_tag.golden.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 2 additions & 8 deletions operator/cmd/mesh/testdata/manifest-generate/output/flag_force.golden.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.