added priviledged=true to the init container and to all tests #922
Conversation
|
So there's good news and bad news. 👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there. 😕 The bad news is that it appears that one or more commits were authored by someone other than the pull request submitter. We need to confirm that they're okay with their commits being contributed to this project. Please have them confirm that here in the pull request. Note to project maintainer: This is a terminal state, meaning the |
|
Jenkins job pilot/presubmit passed |
|
The mystery is still why SELinux requires more capabilities than NET_ADMIN for iptables. |
|
Jenkins job pilot/e2e-smoketest passed |
| @@ -131,6 +131,7 @@ func injectIntoPodTemplateSpec(p *Params, t *v1.PodTemplateSpec) error { | |||
| "capabilities": map[string]interface{}{ | |||
| "add": []string{"NET_ADMIN"}, | |||
| }, | |||
| "privileged": true, | |||
There was a problem hiding this comment.
Quick feedback. We know that stuff works in Kube without this. And we know that for OpenShift, we need this. Rather than elevating privileges for all cases, can we constrain this to just OpenShift only? This need not be done in this PR, as I don't want to add onto @bjartek 's commits. Lets get this in and may be figure out an istioctl option for this?
|
next time let's make sure to add the credit in the commit message itself |
|
Let me know if you need more help with istio/Openshift :) |
|
so it turns out this is required after all ? should we revert this ? https://groups.google.com/d/msg/istio-users/8gI2DdnvOag/Ds_6oG-bBgAJ |
|
The reason I did this patch is not that post. There was issues when SELinux is enabled. Setting priviledged=true fixed it.
|bjarte
…Sent from my iPhone
On 14 Jul 2017, at 02:27, Laurent Demailly ***@***.***> wrote:
so it turns out this is required after all ? should we revert this ?
https://groups.google.com/d/msg/istio-users/8gI2DdnvOag/Ds_6oG-bBgAJ
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.
|
Commit #921 on behalf of @bjartek.
Add
privileged=trueto init-containers to unblock deployments with SELINUX (e.g. OpenShift). As @bjartek suggested in his original PR, this is functionally sufficient, but longer term someone needs to sort through what exact permissions are needed with SELinux and add the necessary RBAC rules to OpenShift similar to what what it is for Kubernetes in the main repo.Fixes istio/old_issues_repo#34