kubernetes
/
minikube
mirror of https://github.com/kubernetes/minikube.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #18421 from prezha/privilegedPorts 

add default sysctls to allow privileged ports with no capabilities
pull/17786/head
Steven Powell 2024-03-18 15:17:21 -07:00 committed by GitHub
parent c46b9b4325 715903ea5b
commit ccbaa190ea
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/minikube/cruntime/containerd.go
View File

@ -177,6 +177,21 @@ func generateContainerdConfig(cr CommandRunner, imageRepository string, kv semve
return errors.Wrap(err, "update conf_dir")
}
// enable 'enable_unprivileged_ports' so that containers that run with non-root user can bind to otherwise privilege ports (like coredns v1.11.0+)
// note: 'net.ipv4.ip_unprivileged_port_start' sysctl was marked as safe since kubernetes v1.22 (Aug 4, 2021) (ref: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md#feature-9)
// note: containerd supports 'enable_unprivileged_ports' option since v1.6.0-beta.3 (Nov 19, 2021) (ref: https://github.com/containerd/containerd/releases/tag/v1.6.0-beta.3; https://github.com/containerd/containerd/pull/6170)
// note: minikube bumped containerd version to greater than v1.6.0 on May 19, 2022 (ref: https://github.com/kubernetes/minikube/pull/14152)
if kv.GTE(semver.Version{Major: 1, Minor: 22}) {
// remove any existing 'enable_unprivileged_ports' settings
if _, err := cr.RunCmd(exec.Command("sh", "-c", fmt.Sprintf(`sudo sed -i '/^ *enable_unprivileged_ports = .*/d' %s`, containerdConfigFile))); err != nil {
return errors.Wrap(err, "removing enable_unprivileged_ports")
}
// add 'enable_unprivileged_ports' with value 'true'
if _, err := cr.RunCmd(exec.Command("sh", "-c", fmt.Sprintf(`sudo sed -i -r 's|^( *)\[plugins."io.containerd.grpc.v1.cri"\]|&\n\1 enable_unprivileged_ports = true|' %s`, containerdConfigFile))); err != nil {
return errors.Wrap(err, "configuring enable_unprivileged_ports")
}
}
for _, registry := range insecureRegistry {
addr := registry
if strings.HasPrefix(strings.ToLower(registry), "http://") || strings.HasPrefix(strings.ToLower(registry), "https://") {

18
pkg/minikube/cruntime/crio.go
View File

@ -89,6 +89,24 @@ func generateCRIOConfig(cr CommandRunner, imageRepository string, kv semver.Vers
klog.Warningf("unable to remove /etc/cni/net.mk directory: %v", err)
}
// add 'net.ipv4.ip_unprivileged_port_start=0' sysctl so that containers that run with non-root user can bind to otherwise privilege ports (like coredns v1.11.0+)
// note: 'net.ipv4.ip_unprivileged_port_start' sysctl was marked as safe since Kubernetes v1.22 (Aug 4, 2021) (ref: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md#feature-9)
// note: cri-o supports 'default_sysctls' option since v1.12.0 (Oct 19, 2018) (ref: https://github.com/cri-o/cri-o/releases/tag/v1.12.0; https://github.com/cri-o/cri-o/pull/1721)
if kv.GTE(semver.Version{Major: 1, Minor: 22}) {
// remove any existing 'net.ipv4.ip_unprivileged_port_start' settings
if _, err := cr.RunCmd(exec.Command("sh", "-c", fmt.Sprintf(`sudo sed -i '/^ *"net.ipv4.ip_unprivileged_port_start=.*"/d' %s`, crioConfigFile))); err != nil {
return errors.Wrap(err, "removing net.ipv4.ip_unprivileged_port_start")
}
// insert 'default_sysctls' list, if not already present
if _, err := cr.RunCmd(exec.Command("sh", "-c", fmt.Sprintf(`sudo grep -q "^ *default_sysctls" %s || sudo sed -i '/conmon_cgroup = .*/a default_sysctls = \[\n\]' %s`, crioConfigFile, crioConfigFile))); err != nil {
return errors.Wrap(err, "inserting default_sysctls")
}
// add 'net.ipv4.ip_unprivileged_port_start' to 'default_sysctls' list
if _, err := cr.RunCmd(exec.Command("sh", "-c", fmt.Sprintf(`sudo sed -i -r 's|^default_sysctls *= *\[|&\n "net.ipv4.ip_unprivileged_port_start=0",|' %s`, crioConfigFile))); err != nil {
return errors.Wrap(err, "configuring net.ipv4.ip_unprivileged_port_start")
}
}
return nil
}