Allow proxy-init container to run as non-root #7162

chrischdi · 2021-10-27T16:12:43Z

Linkerd proxy-init container is currently enforced to run as root.

Removes hardcoding runAsNonRoot: false and runAsUser: 0. This way
the container inherits the user ID from the proxy-init image instead which
may allow to run as non-root.

Validation should happen during the usual tests.

Fixes #5505

Signed-off-by: Schlotter, Christian christian.schlotter@daimler.com

Requires linkerd/linkerd2-proxy-init#49 for having the correct capabilities set for the iptables binaries.

It would be also possible to keep the option for users to run as root by adding something like:

  {{- if .Values.proxyInit.runAsRoot }}
  runAsNonRoot: false
  runAsUser: 0
  {{- end }}

Christian Schlotter christian.schlotter@daimler.com, Daimler AG on behalf of Daimler TSS GmbH

Provider Information

alpeb · 2021-10-27T20:35:25Z

charts/partials/templates/_proxy-init.tpl

@@ -44,8 +44,6 @@ securityContext:
  privileged: false
  {{- end }}
  readOnlyRootFilesystem: true
-  runAsNonRoot: false


According to k8s reference docs, the default for runAsNonRoot is already false. So I think we should have here runAsNonRoot: true instead, for the Kubelet to check that the container is not triggered under user 0.

I re-added runAsNonRoot and set it to true. This will enforce the proxy-init container that it needs to run as non-root.

This then will require the changes from linkerd/linkerd2-proxy-init#49 .

Indicates that the container must run as a non-root user. If true, the
Kubelet will validate the image at runtime to ensure that it does not run
as UID 0 (root) and fail to start the container if it does. If unset or
false, no such validation will be performed. May also be set in
PodSecurityContext. If set in both SecurityContext and PodSecurityContext,
the value specified in SecurityContext takes precedence.
(from kubectl explain pod.spec.initContainers.securityContext.runAsNonRoot

chrischdi · 2021-10-28T11:30:40Z

As mentioned I re-added runAsNonRoot and set it to true. This will enforce the proxy-init container that it needs to run as non-root.

I also adjusted the tests to match the new chart.

alpeb · 2021-10-28T15:05:17Z

Thanks @chrischdi, we'll wait for linkerd/linkerd2-proxy-init#49 to get one more review to get it merged, then I'll create a new release v1.5.0. Then you can update this current PR to pick up that new proxy-init version 👍

chrischdi · 2021-10-29T10:50:13Z

As mentioned in linkerd/linkerd2-proxy-init#49 (comment) :

We may have to switch to the following because of the configurable proxyInit.closeWaitTimeoutSecs which would require root permissions due to the execution of sysctl.

{{- if .Values.proxyInit.closeWaitTimeoutSecs }}
privileged: true
runAsNonRoot: false
runAsUser: 0
{{- else }}
privileged: false
runAsNonRoot: true
{{- end }}

chrischdi · 2021-11-03T05:54:32Z

requires rebase after #7203 was done :-)

chrischdi · 2021-11-04T08:43:00Z

Rebased changes to main branch because #7203 got merged :-)

chrischdi · 2021-11-04T08:59:21Z

As mentioned in linkerd/linkerd2-proxy-init#49 (comment) :

We may have to switch to the following because of the configurable proxyInit.closeWaitTimeoutSecs which would require root permissions due to the execution of sysctl.
{{- if .Values.proxyInit.closeWaitTimeoutSecs }}
privileged: true
runAsNonRoot: false
runAsUser: 0
{{- else }}
privileged: false
runAsNonRoot: true
{{- end }}

Still requires this change, I'll update the PR

alpeb

Looking good. So the idea is to have proxy-init run as non-root, unless closeWaitTimeoutSecs is used. Any objections to that @mateiidavid ?
Also could you please take care of the DCO?

test/integration/inject/inject_test.go

chrischdi · 2021-11-04T15:41:35Z

Looking good. So the idea is to have proxy-init run as non-root, unless closeWaitTimeoutSecs is used. Any objections to that @mateiidavid ? Also could you please take care of the DCO?

Thanks for the review.

Looks like I missed the zero and signing the commits again :-) should be ok now 👍

alpeb

Thanks @chrischdi !

mateiidavid · 2021-11-05T04:09:56Z

Looking good. So the idea is to have proxy-init run as non-root, unless closeWaitTimeoutSecs is used. Any objections to that @mateiidavid ?
Also could you please take care of the DCO?

Not at all! Think everything looks great.

mateiidavid

I think you might have to do yet another rebase, sorry about that. We bumped up proxy-init to v1.5.1, the base image was modified. Ready to 🚢 from my side after that.

Linkerd proxy-init container is currently enforced to run as root. Removes hardcoding `runAsNonRoot: false` and `runAsUser: 0`. This way the container inherits the user ID from the proxy-init image instead which may allow to run as non-root. Validation should happen during the usual tests. Fixes linkerd#5505 Signed-off-by: Schlotter, Christian <christian.schlotter@daimler.com>

chrischdi · 2021-11-05T07:38:31Z

I think you might have to do yet another rebase, sorry about that. We bumped up proxy-init to v1.5.1, the base image was modified. Ready to ship from my side after that.

No worries :-) done, I squashed the commits again, I hope that's okay (the second and third only have been fixups).

part-time-githubber · 2021-11-15T22:00:44Z

@alpeb So how do we track down which stable release this is is going to make into, and when?

kleimkuhler · 2021-11-15T22:07:43Z

Additive changes like this typically make it into the next stable release which will 2.12 and likely sometime early 2022.

If there is a stable 2.11.2 we could maybe consider bringing this in especially if 2.12 is still far enough out, but it's not very likely. We'll also want to make sure a change like this has a few edge releases to be tested out in before including it in a stable release.

part-time-githubber · 2021-11-15T22:19:41Z

@kleimkuhler many thanks for the prompt response on this!

Linkerd proxy-init container is currently enforced to run as root. Removes hardcoding `runAsNonRoot: false` and `runAsUser: 0`. This way the container inherits the user ID from the proxy-init image instead which may allow to run as non-root. Fixes #5505 Signed-off-by: Schlotter, Christian <christian.schlotter@daimler.com> (cherry picked from commit 9853353) Signed-off-by: Oliver Gould <ver@buoyant.io>

chrischdi requested a review from a team as a code owner October 27, 2021 16:12

chrischdi mentioned this pull request Oct 27, 2021

Linkerd without CNI as non-root linkerd/linkerd2-proxy-init#49

Merged

alpeb reviewed Oct 27, 2021

View reviewed changes

chrischdi mentioned this pull request Nov 3, 2021

Upgrade proxy-init to v1.5.0 #7203

Merged

chrischdi force-pushed the schloc/proxy-init-nonroot branch from a5287b0 to 0a2e9ea Compare November 4, 2021 08:42

chrischdi force-pushed the schloc/proxy-init-nonroot branch from 0a2e9ea to 9402a9d Compare November 4, 2021 10:35

alpeb reviewed Nov 4, 2021

View reviewed changes

test/integration/inject/inject_test.go Show resolved Hide resolved

chrischdi force-pushed the schloc/proxy-init-nonroot branch from bf899a9 to 74a176a Compare November 4, 2021 15:41

alpeb approved these changes Nov 4, 2021

View reviewed changes

adleong approved these changes Nov 4, 2021

View reviewed changes

mateiidavid approved these changes Nov 5, 2021

View reviewed changes

chrischdi force-pushed the schloc/proxy-init-nonroot branch from 74a176a to 6bf93e3 Compare November 5, 2021 07:38

alpeb approved these changes Nov 5, 2021

View reviewed changes

alpeb merged commit 9853353 into linkerd:main Nov 5, 2021

Pothulapati mentioned this pull request Nov 8, 2021

pin k8s versions with integration tests #7236

Merged

adleong mentioned this pull request Nov 18, 2021

add option to run proxy-init as root #7308

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow proxy-init container to run as non-root #7162

Allow proxy-init container to run as non-root #7162

chrischdi commented Oct 27, 2021

alpeb Oct 27, 2021

chrischdi Oct 28, 2021

chrischdi commented Oct 28, 2021

alpeb commented Oct 28, 2021

chrischdi commented Oct 29, 2021 •

edited

Loading

chrischdi commented Nov 3, 2021

chrischdi commented Nov 4, 2021

chrischdi commented Nov 4, 2021

alpeb left a comment

chrischdi commented Nov 4, 2021

alpeb left a comment

mateiidavid commented Nov 5, 2021

mateiidavid left a comment

chrischdi commented Nov 5, 2021

part-time-githubber commented Nov 15, 2021 •

edited

Loading

kleimkuhler commented Nov 15, 2021

part-time-githubber commented Nov 15, 2021

Allow proxy-init container to run as non-root #7162

Allow proxy-init container to run as non-root #7162

Conversation

chrischdi commented Oct 27, 2021

alpeb Oct 27, 2021

Choose a reason for hiding this comment

chrischdi Oct 28, 2021

Choose a reason for hiding this comment

chrischdi commented Oct 28, 2021

alpeb commented Oct 28, 2021

chrischdi commented Oct 29, 2021 • edited Loading

chrischdi commented Nov 3, 2021

chrischdi commented Nov 4, 2021

chrischdi commented Nov 4, 2021

alpeb left a comment

Choose a reason for hiding this comment

chrischdi commented Nov 4, 2021

alpeb left a comment

Choose a reason for hiding this comment

mateiidavid commented Nov 5, 2021

mateiidavid left a comment

Choose a reason for hiding this comment

chrischdi commented Nov 5, 2021

part-time-githubber commented Nov 15, 2021 • edited Loading

kleimkuhler commented Nov 15, 2021

part-time-githubber commented Nov 15, 2021

chrischdi commented Oct 29, 2021 •

edited

Loading

part-time-githubber commented Nov 15, 2021 •

edited

Loading