Use correct calico-node UID when running in non-privileged mode. #2645
Conversation
| }, | ||
| SecurityContext: securitycontext.NewRootContext(false), | ||
| SecurityContext: securitycontext.NewRootContext(true), |
There was a problem hiding this comment.
Why is this changed to true (privileged)? If this is for chown permissions, maybe we can try to add the CHOWN cap first?
There was a problem hiding this comment.
I see issues when the init container does mkdirAll /var/log/calico/cni.
There was a problem hiding this comment.
@sridhartigera do you know why this was working before then? Or was it never working? Or is this only needed for BPF mode? Or something about your setup?
pkg/render/node_test.go
Outdated
| @@ -896,7 +897,7 @@ var _ = Describe("Node rendering tests", func() { | |||
|
|
|||
| // hostpath init container should have the correct env and security context. | |||
| hostPathContainer := rtest.GetContainer(ds.Spec.Template.Spec.InitContainers, "hostpath-init") | |||
| rtest.ExpectEnv(hostPathContainer.Env, "NODE_USER_ID", "999") | |||
| rtest.ExpectEnv(hostPathContainer.Env, "NODE_USER_ID", fmt.Sprintf("%d", securitycontext.GetNonRootUID())) | |||
There was a problem hiding this comment.
You can use string "10001" directly here and remove the new GetNonRootUID() function in security_context.go.
| @@ -76,3 +76,8 @@ func NewNonRootPodContext() *corev1.PodSecurityContext { | |||
| }, | |||
| } | |||
| } | |||
|
|
|||
| // GetNonRootUID returns the non-root UID | |||
There was a problem hiding this comment.
runAsUserID is intentionally made private to hide UID/GID from the caller. You can use 10001 directly in your test. We do this in other places as well, for example,
operator/pkg/render/node_test.go
Line 881 in 88d6475
Use correct calico-node UID when running in non-privileged mode.
Use correct calico-node UID when running in non-privileged mode.
Merge pull request #2645 from sridhartigera/host-path-init
Description
When enabling non-privileged mode, the ownership of directories that
calico-nodeuses should be changed to UID of calico-node.In non-privileged mode, the UID of calico-node is 10001.
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this is a bugfix.kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.