Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure runAsUser=0 on injected proxyinit container's security context #567

Open
rimaulana opened this issue Mar 30, 2022 · 1 comment
Labels
enhancement New feature or request

Comments

@rimaulana
Copy link

Is your feature request related to a problem?
When pod has podSecurityContext that define the default runAsUser other than 0, proxyinit initContainers are failing with the following error message

Fatal: can't open lock file /run/xtables.lock: Permission denied

Describe the solution you'd like
It is understandable that proxyinit will execute iptables command to deploy some traffic redirection rules and it requires to run as root user. If this is a hard requirement, I would want the appmesh-controller to inject this as part of container security context. The current injected container security context is

securityContext:
  capabilities:
    add:
    - NET_ADMIN

What I would like to see is to look like

securityContext:
  runAsUser: 0
  capabilities:
    add:
    - NET_ADMIN
@rimaulana rimaulana added the enhancement New feature or request label Mar 30, 2022
@rimaulana rimaulana changed the title Configure runAsUser=0 on injected proxyinit container security context Configure runAsUser=0 on injected proxyinit container's security context Mar 30, 2022
@petrzjunior
Copy link

Despite the pull request years ago, this is still an open issue.
I am using AWS AppMesh in a restricted environment with security context set to non-root user. This is currently blocking me, I need to set securityContext to root for the whole pod where a container-specific securityContext for Envoy would be sufficient.
I basically do not a scenario where NOT setting the container securityContext to root would work. It is trying to lock /run/xtables.lock and fails.
I am not proficient in Go to open a PR, perhaps some of the maintainers could help us? @ysdongAmazon @srinivas-kini

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
2 participants