cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
35 lines
1.2 KiB
Django/Jinja
35 lines
1.2 KiB
Django/Jinja
[Unit]
|
|
Description=etcd docker wrapper
|
|
Wants=docker.socket
|
|
After=docker.service
|
|
|
|
[Service]
|
|
User=root
|
|
PermissionsStartOnly=true
|
|
ExecStart={{ docker_bin_dir }}/docker run --restart=on-failure:5 \
|
|
--env-file=/etc/etcd.env \
|
|
{# TODO(mattymo): Allow docker IP binding and disable in envfile
|
|
-p 2380:2380 -p 2379:2379 #}
|
|
--net=host \
|
|
-v /etc/ssl/certs:/etc/ssl/certs:ro \
|
|
-v {{ etcd_cert_dir }}:{{ etcd_cert_dir }}:ro \
|
|
-v /var/lib/etcd:/var/lib/etcd:rw \
|
|
{% for c in etcd_drop_cap %}
|
|
--cap-drop={{ c }} \
|
|
{% endfor %}
|
|
--memory={{ etcd_memory_limit|regex_replace('Mi', 'M') }} --cpu-shares={{ etcd_cpu_limit|regex_replace('m', '') }} \
|
|
--name={{ etcd_member_name | default("etcd") }} \
|
|
-u {{ etcd_user_id }}:{{ etcd_group_id }} --group-add {{ etcd_cert_group_id }} \
|
|
{{ etcd_image_repo }}:{{ etcd_image_tag }} \
|
|
{% if etcd_after_v3 %}
|
|
{{ etcd_container_bin_dir }}etcd
|
|
{% endif %}
|
|
ExecStartPre=-{{ docker_bin_dir }}/docker rm -f {{ etcd_member_name | default("etcd") }}
|
|
ExecReload={{ docker_bin_dir }}/docker restart {{ etcd_member_name | default("etcd") }}
|
|
ExecStop={{ docker_bin_dir }}/docker stop {{ etcd_member_name | default("etcd") }}
|
|
Restart=always
|
|
RestartSec=15s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|