From c8ec77a7344e8e05d2728ddcbdea7b17e92610f6 Mon Sep 17 00:00:00 2001 From: Fredrik Liv Date: Fri, 9 Dec 2022 15:16:12 +0100 Subject: [PATCH] [containerd] Add config for unpriviledged ports and icmp (#9517) * [containerd] Add config for unpriviledged ports and icmp * Updated to match true false variables of other setting --- roles/container-engine/containerd/defaults/main.yml | 5 +++++ roles/container-engine/containerd/templates/config.toml.j2 | 2 ++ 2 files changed, 7 insertions(+) diff --git a/roles/container-engine/containerd/defaults/main.yml b/roles/container-engine/containerd/defaults/main.yml index a5ef23637..83115c4fa 100644 --- a/roles/container-engine/containerd/defaults/main.yml +++ b/roles/container-engine/containerd/defaults/main.yml @@ -52,6 +52,11 @@ containerd_registries: containerd_max_container_log_line_size: -1 +# If enabled it will allow non root users to use port numbers <1024 +containerd_enable_unprivileged_ports: false +# If enabled it will allow non root users to use icmp sockets +containerd_enable_unprivileged_icmp: false + containerd_cfg_dir: /etc/containerd # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally diff --git a/roles/container-engine/containerd/templates/config.toml.j2 b/roles/container-engine/containerd/templates/config.toml.j2 index 7ffe37045..c1bda12b8 100644 --- a/roles/container-engine/containerd/templates/config.toml.j2 +++ b/roles/container-engine/containerd/templates/config.toml.j2 @@ -18,6 +18,8 @@ oom_score = {{ containerd_oom_score }} [plugins."io.containerd.grpc.v1.cri"] sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}" max_container_log_line_size = {{ containerd_max_container_log_line_size }} + enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | default(false) | lower }} + enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | default(false) | lower }} [plugins."io.containerd.grpc.v1.cri".containerd] default_runtime_name = "{{ containerd_default_runtime | default('runc') }}" snapshotter = "{{ containerd_snapshotter | default('overlayfs') }}"