Pass CAP_NET_BIND_SERVICE to kube-apiserver#7302
Pass CAP_NET_BIND_SERVICE to kube-apiserver#7302vladiskuz wants to merge 1 commit intok0sproject:mainfrom
Conversation
pkg/supervisor/detachattr_unix.go
Outdated
| Setpgid: true, | ||
| Pgid: 0, | ||
| Credential: creds, | ||
| AmbientCaps: ambientCaps, |
There was a problem hiding this comment.
This is a Linux-only API, hence I think we need to split this file into detachattr_linux.go and detachattr_unix.go with a go:build directive of unix && !linux.
pkg/constant/constant.go
Outdated
|
|
||
| // CapNetBindService is the Linux capability to bind to privileged ports (< 1024) | ||
| // See: https://man7.org/linux/man-pages/man7/capabilities.7.html | ||
| CapNetBindService = 10 |
There was a problem hiding this comment.
There was a problem hiding this comment.
Good catch, changed to https://pkg.go.dev/golang.org/x/sys/unix#CAP_NET_BIND_SERVICE
pkg/supervisor/supervisor.go
Outdated
| // Ambient capabilities to pass to the process | ||
| AmbientCaps []uintptr |
There was a problem hiding this comment.
Given that we need to be multi-platform here, and ambient capabilities are Linux only, what about abstracting this into sth. like a RequiredPrivileges struct à la
type RequiredPrivileges struct {
BindsPrivilegedPorts bool
}...that we can pass around? (As always, naming is up for debate 😅 ) That encodes the intent, which can then be translated into platform specifics (i.e. adding ambient capabilities on Linux).
There was a problem hiding this comment.
Added logic with RequiredPrivileges to use the capability in only with Linux
vladiskuz
force-pushed
the
cap-net-bind
branch
3 times, most recently
from
6e93502 to
afbaa07
Compare
|
Looks good so far! The linter has some nits, tho ... |
|
@twz123t looks like all the issues are fixed. But I don't see the new integration test running. What did I do wrong? |
When the Kubernetes API server is configured to listen on a privileged port (< 1024), k0s now automatically grants the CAP_NET_BIND_SERVICE Linux capabilibty to the kube-apiserver process. This allows the non-root process to bind to ports like 443 without requiring full root privileges. Signed-off-by: Vladislav Kuzmin <vladiskuz@gmail.com>
2 participants
Description
When the Kubernetes API server is configured to listen on a privileged port (< 1024), k0s now automatically grants the CAP_NET_BIND_SERVICE Linux capabilibty to the kube-apiserver process. This allows the non-root process to bind to ports like 443 without requiring full root privileges.
Type of change
How Has This Been Tested?
Checklist
Closes #7221