cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
---
|
|
- name: User | Create Certificate Access Groups
|
|
group: name={{ item }} system=yes
|
|
with_items: "{{ user.groups.split(',') }}"
|
|
|
|
- name: User | Create User Group
|
|
group: name={{user.group|default(user.name)}} system={{user.system|default(omit)}}
|
|
|
|
- name: User | Create cloud-init user
|
|
template:
|
|
dest: /etc/{{ user.name }}_user_cloud_init_conf
|
|
src: users.j2
|
|
owner: root
|
|
mode: 0640
|
|
notify: User | update users for cloud-init
|
|
when: "{{ user.type|default('standard') == 'cloud-init' }}"
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: User | Hack groups for existing cloud-init users CoreOS
|
|
command: /usr/sbin/usermod -aG {{ item }} {{ user.name }}
|
|
with_items: "{{ user.groups.split(',') }}"
|
|
when: "{{ ansible_os_family in ['CoreOS', 'Container Linux by CoreOS'] and user.type|default('standard') == 'cloud-init' }}"
|
|
|
|
- name: User | Create User
|
|
user:
|
|
comment: "{{user.comment|default(omit)}}"
|
|
createhome: "{{user.createhome|default(omit)}}"
|
|
group: "{{user.group|default(user.name)}}"
|
|
groups: "{{user.groups|default(omit)}}"
|
|
home: "{{user.home|default(omit)}}"
|
|
shell: "{{user.shell|default(omit)}}"
|
|
name: "{{user.name}}"
|
|
system: "{{user.system|default(omit)}}"
|
|
when: "{{ user.type|default('standard') != 'cloud-init' }}"
|