docs/envoy-authorization: update to transport APIv3, Envoy 1.17 #3102
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Recent versions of envoy's docker container have changed the way
dropping privileges works:
- it happens by default
- it's not driven by `securityContext.runAsUser`
So in the docker container's entrypoint, the environment will be
set up: /dev/std{err,out} will be chowned to an unprivileged user,
which will have uid ENVOY_UID. Hence we set that env variable to
match the UID we us with iptables in open-policy-agent/proxy_init.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
srenatus
commented
Jan 26, 2021
Comment on lines
+287
to
+289
| env: | ||
| - name: ENVOY_UID | ||
| value: "1111" |
There was a problem hiding this comment.
I've reduced the indentation a bit, so this doesn't stand out as much as it should -- this is the piece that fixes
chown: changing ownership of '/dev/stdout': Operation not permitted
chown: changing ownership of '/dev/stderr': Operation not permitted
|
Interestingly, the rego policy used in the tutorial is in the intersection of how v2 and v3 encode their check requests 😄 |
|
this is the page rendered: https://deploy-preview-3102--openpolicyagent.netlify.app/docs/edge/envoy-authorization/ |
tsandall
approved these changes
Jan 26, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Recent versions of envoy's docker container have changed the way
dropping privileges works:
securityContext.runAsUserSo in the docker container's entrypoint, the environment will be
set up: /dev/std{err,out} will be chowned to an unprivileged user,
which will have uid ENVOY_UID. Hence we set that env variable to
match the UID we us with iptables in open-policy-agent/proxy_init.
Fixes #3101 and the issue described in #3091.