48e77cd8bb
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
46 lines
1 KiB
YAML
46 lines
1 KiB
YAML
# change to 0.0.0.0 to enable insecure access from anywhere (not recommended)
|
|
kube_apiserver_insecure_bind_address: 127.0.0.1
|
|
|
|
# resolv.conf to base dns config
|
|
kube_resolv_conf: "/etc/resolv.conf"
|
|
|
|
kube_proxy_mode: iptables
|
|
|
|
# If using the pure iptables proxy, SNAT everything
|
|
kube_proxy_masquerade_all: true
|
|
|
|
# Limits for kube components and nginx load balancer app
|
|
kubelet_memory_limit: 512M
|
|
kubelet_cpu_limit: 100m
|
|
kube_proxy_memory_limit: 2000M
|
|
kube_proxy_cpu_limit: 500m
|
|
kube_proxy_memory_requests: 256M
|
|
kube_proxy_cpu_requests: 150m
|
|
nginx_memory_limit: 512M
|
|
nginx_cpu_limit: 300m
|
|
nginx_memory_requests: 64M
|
|
nginx_cpu_requests: 50m
|
|
|
|
# kube_api_runtime_config:
|
|
# - extensions/v1beta1/daemonsets=true
|
|
# - extensions/v1beta1/deployments=true
|
|
|
|
nginx_image_repo: nginx
|
|
nginx_image_tag: 1.11.4-alpine
|
|
|
|
etcd_config_dir: /etc/ssl/etcd
|
|
|
|
# Linux capabilities to be dropped for container engines
|
|
apps_drop_cap:
|
|
- chown
|
|
- dac_override
|
|
- fowner
|
|
- fsetid
|
|
- kill
|
|
- setgid
|
|
- setuid
|
|
- setpcap
|
|
- sys_chroot
|
|
- mknod
|
|
- audit_write
|
|
- setfcap
|