Skip to content

Commit 832dce2

Browse files
mburke5678mburke5678
authored
Merge pull request #52932 from kquinn1204/TELCODOCS-681
TELCODOCS-681 updating interface-specific systl allowlist
2 parents 9b448a7 + c3958a0 commit 832dce2

File tree

3 files changed

+227
-4
lines changed

3 files changed

+227
-4
lines changed

‎modules/nodes-safe-sysctls-list.adoc

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,6 @@ a| This restricts `ICMP_PROTO` datagram sockets to users in the group range. The
5757
|===
5858
| sysctl | Description
5959

60-
| `net.ipv4.conf.IFNAME.accept_ra`
61-
a|Accept IPv4 Router Advertisements; autoconfigure using them. It also determines whether or not to transmit router solicitations. Router solicitations are transmitted only if the functional setting is to accept router advertisements.
62-
6360
| `net.ipv4.conf.IFNAME.accept_redirects`
6461
a| Accept IPv4 ICMP redirect messages.
6562

‎modules/update-network-sysctl-allowlist.adoc

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/containers/nodes-containers-sysctls.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="updating-interface-specific-safe-sysctls-list_{context}"]
7+
= Updating the interface-specific safe sysctls list
8+
9+
{product-title} includes a predefined list of safe interface-specific `sysctls`. You can modify this list by updating the `cni-sysctl-allowlist` in the `openshift-multus` namespace.
10+
11+
[IMPORTANT]
12+
====
13+
The support for updating the interface-specific safe sysctls list is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
14+
15+
For more information about the support scope of Red Hat Technology Preview
16+
features, see https://access.redhat.com/support/offerings/techpreview/.
17+
====
18+
19+
Follow this procedure to modify the predefined list of safe `sysctls`. This procedure describes how to extend the default allow list.
20+
21+
.Procedure
22+
23+
. View the existing predefined list by running the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ oc get cm -n openshift-multus cni-sysctl-allowlist -oyaml
28+
----
29+
+
30+
.Expected output
31+
+
32+
[source,terminal]
33+
----
34+
apiVersion: v1
35+
data:
36+
allowlist.conf: |-
37+
^net.ipv4.conf.IFNAME.accept_redirects$
38+
^net.ipv4.conf.IFNAME.accept_source_route$
39+
^net.ipv4.conf.IFNAME.arp_accept$
40+
^net.ipv4.conf.IFNAME.arp_notify$
41+
^net.ipv4.conf.IFNAME.disable_policy$
42+
^net.ipv4.conf.IFNAME.secure_redirects$
43+
^net.ipv4.conf.IFNAME.send_redirects$
44+
^net.ipv6.conf.IFNAME.accept_ra$
45+
^net.ipv6.conf.IFNAME.accept_redirects$
46+
^net.ipv6.conf.IFNAME.accept_source_route$
47+
^net.ipv6.conf.IFNAME.arp_accept$
48+
^net.ipv6.conf.IFNAME.arp_notify$
49+
^net.ipv6.neigh.IFNAME.base_reachable_time_ms$
50+
^net.ipv6.neigh.IFNAME.retrans_time_ms$
51+
kind: ConfigMap
52+
metadata:
53+
annotations:
54+
kubernetes.io/description: |
55+
Sysctl allowlist for nodes.
56+
release.openshift.io/version: 4.12.0-0.nightly-2022-11-16-003434
57+
creationTimestamp: "2022-11-17T14:09:27Z"
58+
name: cni-sysctl-allowlist
59+
namespace: openshift-multus
60+
resourceVersion: "2422"
61+
uid: 96d138a3-160e-4943-90ff-6108fa7c50c3
62+
----
63+
64+
. Edit the list by using the following command:
65+
+
66+
[source,terminal]
67+
----
68+
$ oc edit cm -n openshift-multus cni-sysctl-allowlist -oyaml
69+
----
70+
+
71+
For example, to allow you to be able to implement stricter reverse path forwarding you need to add `^net.ipv4.conf.IFNAME.rp_filter$` and `^net.ipv6.conf.IFNAME.rp_filter$` to the list as shown here:
72+
+
73+
[source,terminal]
74+
----
75+
# Please edit the object below. Lines beginning with a '#' will be ignored,
76+
# and an empty file will abort the edit. If an error occurs while saving this file will be
77+
# reopened with the relevant failures.
78+
#
79+
apiVersion: v1
80+
data:
81+
allowlist.conf: |-
82+
^net.ipv4.conf.IFNAME.accept_redirects$
83+
^net.ipv4.conf.IFNAME.accept_source_route$
84+
^net.ipv4.conf.IFNAME.arp_accept$
85+
^net.ipv4.conf.IFNAME.arp_notify$
86+
^net.ipv4.conf.IFNAME.disable_policy$
87+
^net.ipv4.conf.IFNAME.secure_redirects$
88+
^net.ipv4.conf.IFNAME.send_redirects$
89+
^net.ipv4.conf.IFNAME.rp_filter$
90+
^net.ipv6.conf.IFNAME.accept_ra$
91+
^net.ipv6.conf.IFNAME.accept_redirects$
92+
^net.ipv6.conf.IFNAME.accept_source_route$
93+
^net.ipv6.conf.IFNAME.arp_accept$
94+
^net.ipv6.conf.IFNAME.arp_notify$
95+
^net.ipv6.neigh.IFNAME.base_reachable_time_ms$
96+
^net.ipv6.neigh.IFNAME.retrans_time_ms$
97+
^net.ipv6.conf.IFNAME.rp_filter$
98+
----
99+
100+
. Save the changes to the file and exit.
101+
+
102+
[NOTE]
103+
====
104+
The removal of `sysctls` is also supported. Edit the file, remove the `sysctl` or `sysctls` then save the changes and exit.
105+
====
106+
107+
.Verification
108+
109+
Follow this procedure to enforce stricter reverse path forwarding for IPv4.
110+
For more information on reverse path forwarding see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-reverse_path_forwarding[Reverse Path Forwarding
111+
].
112+
113+
. Create a network attachment definition, such as `reverse-path-fwd-example.yaml`, with the following content:
114+
+
115+
[source,yaml]
116+
----
117+
apiVersion: "k8s.cni.cncf.io/v1"
118+
kind: NetworkAttachmentDefinition
119+
metadata:
120+
name: tuningnad
121+
namespace: default
122+
spec:
123+
config: '{
124+
"cniVersion": "0.4.0",
125+
"name": "tuningnad",
126+
"plugins": [{
127+
"type": "bridge"
128+
},
129+
{
130+
"type": "tuning",
131+
"sysctl": {
132+
"net.ipv4.conf.IFNAME.rp_filter": "1"
133+
}
134+
}
135+
]
136+
}'
137+
----
138+
139+
. Apply the yaml by running the following command:
140+
+
141+
[source,terminal]
142+
----
143+
$ oc apply -f reverse-path-fwd-example.yaml
144+
----
145+
+
146+
.Example output
147+
[source,terminal]
148+
----
149+
networkattachmentdefinition.k8.cni.cncf.io/tuningnad created
150+
----
151+
152+
. Create a pod such as `examplepod.yaml` using the following YAML:
153+
+
154+
[source,yaml]
155+
----
156+
apiVersion: v1
157+
kind: Pod
158+
metadata:
159+
name: example
160+
labels:
161+
app: httpd
162+
namespace: default
163+
annotations:
164+
k8s.v1.cni.cncf.io/networks: tuningnad <1>
165+
spec:
166+
securityContext:
167+
runAsNonRoot: true
168+
seccompProfile:
169+
type: RuntimeDefault
170+
containers:
171+
- name: httpd
172+
image: 'image-registry.openshift-image-registry.svc:5000/openshift/httpd:latest'
173+
ports:
174+
- containerPort: 8080
175+
securityContext:
176+
allowPrivilegeEscalation: false
177+
capabilities:
178+
drop:
179+
- ALL
180+
----
181+
<1> Specify the name of the configured `NetworkAttachmentDefinition`.
182+
183+
. Apply the yaml by running the following command:
184+
+
185+
[source,terminal]
186+
----
187+
$ oc apply -f examplepod.yaml
188+
----
189+
190+
. Verify that the pod is created by running the following command:
191+
+
192+
[source,terminal]
193+
----
194+
$ oc get pod
195+
----
196+
+
197+
.Example output
198+
[source,terminal]
199+
----
200+
NAME READY STATUS RESTARTS AGE
201+
example 1/1 Running 0 47s
202+
----
203+
204+
. Log in to the pod by running the following command:
205+
+
206+
[source,terminal]
207+
----
208+
$ oc rsh example
209+
----
210+
211+
. Verify the value of the configured sysctl flag. For example, find the value `net.ipv4.conf.net1.rp_filter` by running the following command:
212+
+
213+
[source,terminal]
214+
----
215+
sh-4.4# sysctl net.ipv4.conf.net1.rp_filter
216+
----
217+
+
218+
.Expected output
219+
[source,terminal]
220+
----
221+
net.ipv4.conf.net1.rp_filter = 1
222+
----

‎nodes/containers/nodes-containers-sysctls.adoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,13 @@ include::modules/nodes-namespaced-nodelevel-sysctls.adoc[leveloffset=+1]
3333

3434
include::modules/nodes-safe-sysctls-list.adoc[leveloffset=+1]
3535

36+
include::modules/update-network-sysctl-allowlist.adoc[leveloffset=+1]
37+
3638
[role="_additional-resources"]
3739
.Additional resources
38-
* link:https://docs.kernel.org/networking/ip-sysctl.html[Linux networking documentation]
40+
* xref:../../networking/setting-interface-level-network-sysctls.adoc#nw-configuring-tuning-cni_set-networkinterface-sysctls[Configuring the tuning CNI]
41+
42+
* link:https://docs.kernel.org/networking/ip-sysctl.html[Linux networking documentation]
3943
4044
include::modules/nodes-containers-start-pod-safe-sysctls.adoc[leveloffset=+1]
4145

0 commit comments

Comments
 (0)