Skip to content

Commit eabb424

Browse files
irbekrmirbekrm
authored
cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (tailscale#14262)
We were previously relying on unintended behaviour by runc where all containers where by default given read/write/mknod permissions for tun devices. This behaviour was removed in opencontainers/runc#3468 and released in runc 1.2. Containerd container runtime, used by Docker and majority of Kubernetes distributions bumped runc to 1.2 in 1.7.24 https://github.com/containerd/containerd/releases/tag/v1.7.24 thus breaking our reference tun mode Tailscale Kubernetes manifests and Kubernetes operator proxies. This PR changes the all Kubernetes container configs that run Tailscale in tun mode to privileged. This should not be a breaking change because all these containers would run in a Pod that already has a privileged init container. Updates tailscale#14256 Updates tailscale#10814 Signed-off-by: Irbe Krumina <[email protected]>
1 parent 3f54572 commit eabb424

File tree

9 files changed

+36
-41
lines changed

9 files changed

+36
-41
lines changed

‎cmd/k8s-operator/deploy/crds/tailscale.com_proxyclasses.yaml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1384,11 +1384,12 @@ spec:
13841384
securityContext:
13851385
description: |-
13861386
Container security context.
1387-
Security context specified here will override the security context by the operator.
1388-
By default the operator:
1389-
- sets 'privileged: true' for the init container
1390-
- set NET_ADMIN capability for tailscale container for proxies that
1391-
are created for Services or Connector.
1387+
Security context specified here will override the security context set by the operator.
1388+
By default the operator sets the Tailscale container and the Tailscale init container to privileged
1389+
for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
1390+
You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
1391+
installing device plugin in your cluster and configuring the proxies tun device to be created
1392+
by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
13921393
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
13931394
type: object
13941395
properties:
@@ -1707,11 +1708,12 @@ spec:
17071708
securityContext:
17081709
description: |-
17091710
Container security context.
1710-
Security context specified here will override the security context by the operator.
1711-
By default the operator:
1712-
- sets 'privileged: true' for the init container
1713-
- set NET_ADMIN capability for tailscale container for proxies that
1714-
are created for Services or Connector.
1711+
Security context specified here will override the security context set by the operator.
1712+
By default the operator sets the Tailscale container and the Tailscale init container to privileged
1713+
for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
1714+
You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
1715+
installing device plugin in your cluster and configuring the proxies tun device to be created
1716+
by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
17151717
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
17161718
type: object
17171719
properties:

‎cmd/k8s-operator/deploy/manifests/operator.yaml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1851,11 +1851,12 @@ spec:
18511851
securityContext:
18521852
description: |-
18531853
Container security context.
1854-
Security context specified here will override the security context by the operator.
1855-
By default the operator:
1856-
- sets 'privileged: true' for the init container
1857-
- set NET_ADMIN capability for tailscale container for proxies that
1858-
are created for Services or Connector.
1854+
Security context specified here will override the security context set by the operator.
1855+
By default the operator sets the Tailscale container and the Tailscale init container to privileged
1856+
for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
1857+
You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
1858+
installing device plugin in your cluster and configuring the proxies tun device to be created
1859+
by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
18591860
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
18601861
properties:
18611862
allowPrivilegeEscalation:
@@ -2174,11 +2175,12 @@ spec:
21742175
securityContext:
21752176
description: |-
21762177
Container security context.
2177-
Security context specified here will override the security context by the operator.
2178-
By default the operator:
2179-
- sets 'privileged: true' for the init container
2180-
- set NET_ADMIN capability for tailscale container for proxies that
2181-
are created for Services or Connector.
2178+
Security context specified here will override the security context set by the operator.
2179+
By default the operator sets the Tailscale container and the Tailscale init container to privileged
2180+
for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
2181+
You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
2182+
installing device plugin in your cluster and configuring the proxies tun device to be created
2183+
by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
21822184
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
21832185
properties:
21842186
allowPrivilegeEscalation:

‎cmd/k8s-operator/deploy/manifests/proxy.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,4 @@ spec:
3939
fieldRef:
4040
fieldPath: metadata.uid
4141
securityContext:
42-
capabilities:
43-
add:
44-
- NET_ADMIN
42+
privileged: true

‎cmd/k8s-operator/testutils_test.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,7 @@ func expectedSTS(t *testing.T, cl client.Client, opts configOpts) *appsv1.Statef
7676
{Name: "TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR", Value: "/etc/tsconfig"},
7777
},
7878
SecurityContext: &corev1.SecurityContext{
79-
Capabilities: &corev1.Capabilities{
80-
Add: []corev1.Capability{"NET_ADMIN"},
81-
},
79+
Privileged: ptr.To(true),
8280
},
8381
ImagePullPolicy: "Always",
8482
}

‎docs/k8s/proxy.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,4 @@ spec:
5353
fieldRef:
5454
fieldPath: metadata.uid
5555
securityContext:
56-
capabilities:
57-
add:
58-
- NET_ADMIN
56+
privileged: true

‎docs/k8s/sidecar.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,4 @@ spec:
3535
fieldRef:
3636
fieldPath: metadata.uid
3737
securityContext:
38-
capabilities:
39-
add:
40-
- NET_ADMIN
38+
privileged: true

‎docs/k8s/subnet.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,4 @@ spec:
3737
fieldRef:
3838
fieldPath: metadata.uid
3939
securityContext:
40-
capabilities:
41-
add:
42-
- NET_ADMIN
40+
privileged: true

‎k8s-operator/api.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ _Appears in:_
145145
| `image` _string_ | Container image name. By default images are pulled from<br />docker.io/tailscale/tailscale, but the official images are also<br />available at ghcr.io/tailscale/tailscale. Specifying image name here<br />will override any proxy image values specified via the Kubernetes<br />operator's Helm chart values or PROXY_IMAGE env var in the operator<br />Deployment.<br />https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | |
146146
| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#pullpolicy-v1-core)_ | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.<br />https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | Enum: [Always Never IfNotPresent] <br /> |
147147
| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#resourcerequirements-v1-core)_ | Container resource requirements.<br />By default Tailscale Kubernetes operator does not apply any resource<br />requirements. The amount of resources required wil depend on the<br />amount of resources the operator needs to parse, usage patterns and<br />cluster size.<br />https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources | | |
148-
| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#securitycontext-v1-core)_ | Container security context.<br />Security context specified here will override the security context by the operator.<br />By default the operator:<br />- sets 'privileged: true' for the init container<br />- set NET_ADMIN capability for tailscale container for proxies that<br />are created for Services or Connector.<br />https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context | | |
148+
| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#securitycontext-v1-core)_ | Container security context.<br />Security context specified here will override the security context set by the operator.<br />By default the operator sets the Tailscale container and the Tailscale init container to privileged<br />for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.<br />You can reduce the permissions of the Tailscale container to cap NET_ADMIN by<br />installing device plugin in your cluster and configuring the proxies tun device to be created<br />by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752<br />https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context | | |
149149
| `debug` _[Debug](#debug)_ | Configuration for enabling extra debug information in the container.<br />Not recommended for production use. | | |
150150

151151

‎k8s-operator/apis/v1alpha1/types_proxyclass.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -206,11 +206,12 @@ type Container struct {
206206
// +optional
207207
Resources corev1.ResourceRequirements `json:"resources,omitempty"`
208208
// Container security context.
209-
// Security context specified here will override the security context by the operator.
210-
// By default the operator:
211-
// - sets 'privileged: true' for the init container
212-
// - set NET_ADMIN capability for tailscale container for proxies that
213-
// are created for Services or Connector.
209+
// Security context specified here will override the security context set by the operator.
210+
// By default the operator sets the Tailscale container and the Tailscale init container to privileged
211+
// for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
212+
// You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
213+
// installing device plugin in your cluster and configuring the proxies tun device to be created
214+
// by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
214215
// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
215216
// +optional
216217
SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`

0 commit comments

Comments
 (0)