C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add privileged_without_host_devices support (#7343)

Browse source 
When privileged is enabled for a container, all the `/dev/*` block
devices from the host are mounted into the guest. The
`privileged_without_host_devices` flag prevents host devices from
being passed to privileged containers.

More information:
* https://github.com/containerd/cri/pull/1225
* 1d0f68156b

(cherry picked from commit dc5df57c26)
This commit is contained in:
Victor Morales 2021-03-08 00:17:44 -08:00 committed by Kubernetes Prow Robot
parent 704a054064
commit 01e527abf1
3 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
roles/container-engine/containerd/defaults/main.yml
View file

@ -65,6 +65,7 @@ containerd_default_runtime:
# type: io.containerd.kata.v2 # type: io.containerd.kata.v2
# engine: "" # engine: ""
# root: "" # root: ""
# privileged_without_host_devices: true
containerd_runtimes: [] containerd_runtimes: []
containerd_untrusted_runtime_type: '' containerd_untrusted_runtime_type: ''

2
roles/container-engine/containerd/templates/config.toml.j2
View file

@ -42,6 +42,7 @@ disabled_plugins = ["restart"]
runtime_type = "{{ containerd_default_runtime.type }}" runtime_type = "{{ containerd_default_runtime.type }}"
runtime_engine = "{{ containerd_default_runtime.engine }}" runtime_engine = "{{ containerd_default_runtime.engine }}"
runtime_root = "{{ containerd_default_runtime.root }}" runtime_root = "{{ containerd_default_runtime.root }}"
privileged_without_host_devices = {{ containerd_default_runtime.privileged_without_host_devices|default(false)|lower }}
{% if kata_containers_enabled %} {% if kata_containers_enabled %}
[plugins.cri.containerd.runtimes.kata-qemu] [plugins.cri.containerd.runtimes.kata-qemu]
@ -55,6 +56,7 @@ disabled_plugins = ["restart"]
runtime_type = "{{ runtime.type }}" runtime_type = "{{ runtime.type }}"
runtime_engine = "{{ runtime.engine }}" runtime_engine = "{{ runtime.engine }}"
runtime_root = "{{ runtime.root }}" runtime_root = "{{ runtime.root }}"
privileged_without_host_devices = {{ runtime.privileged_without_host_devices|default(false)|lower }}
{% endfor %} {% endfor %}
[plugins.cri.containerd.untrusted_workload_runtime] [plugins.cri.containerd.untrusted_workload_runtime]

1
roles/container-engine/cri-o/templates/crio.conf.j2
View file

@ -293,6 +293,7 @@ pinns_path = ""
runtime_path = "{{ runtime.path }}" runtime_path = "{{ runtime.path }}"
runtime_type = "{{ runtime.type }}" runtime_type = "{{ runtime.type }}"
runtime_root = "{{ runtime.root }}" runtime_root = "{{ runtime.root }}"
privileged_without_host_devices = {{ runtime.privileged_without_host_devices|default(false)|lower }}
{% endfor %} {% endfor %}
# Kata Containers with the Firecracker VMM # Kata Containers with the Firecracker VMM