cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
15 lines
372 B
Django/Jinja
15 lines
372 B
Django/Jinja
#cloud-config
|
|
users:
|
|
- name: {{ user.name }}
|
|
gecos: {{ user.comment }}
|
|
system: {{ user.system|bool }}
|
|
no-log-init: {{ user.system|bool }}
|
|
primary-group: {{ user.group }}
|
|
no-create-home: {{ not user.createhome|bool }}
|
|
homedir: {{ user.home }}
|
|
shell: {{ user.shell }}
|
|
groups: |
|
|
{% for g in user.groups.split(',') %}
|
|
- {{ g }}
|
|
{% endfor %}
|
|
#
|