C12s
/
c12s-kubespray
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[containerd] Add config for unpriviledged ports and icmp (#9517) 

* [containerd] Add config for unpriviledged ports and icmp

* Updated to match true false variables of other setting
This commit is contained in:
Fredrik Liv 2022-12-09 15:16:12 +01:00 committed by GitHub
parent 4f32f94a51
commit c8ec77a734
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
roles/container-engine/containerd/defaults/main.yml
View File

@ -52,6 +52,11 @@ containerd_registries:
containerd_max_container_log_line_size: -1
# If enabled it will allow non root users to use port numbers <1024
containerd_enable_unprivileged_ports: false
# If enabled it will allow non root users to use icmp sockets
containerd_enable_unprivileged_icmp: false
containerd_cfg_dir: /etc/containerd
# Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally

2
roles/container-engine/containerd/templates/config.toml.j2
View File

@ -18,6 +18,8 @@ oom_score = {{ containerd_oom_score }}
[plugins."io.containerd.grpc.v1.cri"]
sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
max_container_log_line_size = {{ containerd_max_container_log_line_size }}
enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | default(false) | lower }}
enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | default(false) | lower }}
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "{{ containerd_default_runtime | default('runc') }}"
snapshotter = "{{ containerd_snapshotter | default('overlayfs') }}"