Resolving ticket #567, set default runAsUser=0 to init proxy container #576
Conversation
pkg/inject/proxy.go
Outdated
| @@ -8,6 +8,7 @@ import ( | |||
| ) | |||
|
|
|||
| const ( | |||
| defaultRunAsUser = 0 | |||
There was a problem hiding this comment.
Why does proxy need to run as root?
There was a problem hiding this comment.
Although this is defined in proxy.go, the proxy config is only used in initProxyMutator and cniProxyMutator, and in cniProxyMutator, this field is not used so runAsUser is not set there.
pkg/inject/init_proxy.go
Outdated
| @@ -51,6 +51,7 @@ const proxyInitContainerTemplate = ` | |||
| ` | |||
|
|
|||
| type InitContainerTemplateVariables struct { | |||
| RunAsUser int64 | |||
There was a problem hiding this comment.
add this value in the securityContext above.
There was a problem hiding this comment.
The controller will take the template and convert it to a JSON string, no matter what type declared here will become string when calling json.unmarshal function and in K8s corev1 container runAsUser field does not take String as an input, so I have to add this directly to config instead of using template.
pkg/inject/proxy.go
Outdated
| // RunAsUser for init container | ||
| runAsUser int64 |
There was a problem hiding this comment.
Why is the init container config under proxy configs?
There was a problem hiding this comment.
I am not sure why it is there, but I only find this variable used in initProxyMutator and cniProxyMutator so it should not affect the envoy config.
Issue #, if available:
When pod has podSecurityContext that define the default runAsUser other than 0, proxyinit initContainers are failing with the following error message
Fatal: can't open lock file /run/xtables.lock: Permission deniedDescription of changes:
Added default runAsUser value in proxy.go and loaded it into init proxy container's security context in init_proxy.go. Changed the unit tests accordingly.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.