cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
29 lines
514 B
YAML
29 lines
514 B
YAML
---
|
|
etcd_bin_dir: "{{ local_release_dir }}/etcd/etcd-{{ etcd_version }}-linux-amd64/"
|
|
|
|
etcd_config_dir: /etc/ssl/etcd
|
|
etcd_cert_dir: "{{ etcd_config_dir }}/ssl"
|
|
|
|
etcd_script_dir: "{{ bin_dir }}/etcd-scripts"
|
|
|
|
# Linux capabilities to be dropped for container engines
|
|
etcd_drop_cap:
|
|
- chown
|
|
- dac_override
|
|
- fowner
|
|
- fsetid
|
|
- kill
|
|
- setgid
|
|
- setuid
|
|
- setpcap
|
|
- net_bind_service
|
|
- net_raw
|
|
- sys_chroot
|
|
- mknod
|
|
- audit_write
|
|
- setfcap
|
|
|
|
# Limits
|
|
etcd_memory_limit: 512M
|
|
etcd_cpu_limit: 300m
|