You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem?
When pod has podSecurityContext that define the default runAsUser other than 0, proxyinit initContainers are failing with the following error message
Fatal: can't open lock file /run/xtables.lock: Permission denied
Describe the solution you'd like
It is understandable that proxyinit will execute iptables command to deploy some traffic redirection rules and it requires to run as root user. If this is a hard requirement, I would want the appmesh-controller to inject this as part of container security context. The current injected container security context is
rimaulana
changed the title
Configure runAsUser=0 on injected proxyinit container security context
Configure runAsUser=0 on injected proxyinit container's security context
Mar 30, 2022
Despite the pull request years ago, this is still an open issue.
I am using AWS AppMesh in a restricted environment with security context set to non-root user. This is currently blocking me, I need to set securityContext to root for the whole pod where a container-specific securityContext for Envoy would be sufficient.
I basically do not a scenario where NOT setting the container securityContext to root would work. It is trying to lock /run/xtables.lock and fails.
I am not proficient in Go to open a PR, perhaps some of the maintainers could help us? @ysdongAmazon@srinivas-kini
Is your feature request related to a problem?
When pod has podSecurityContext that define the default runAsUser other than 0, proxyinit initContainers are failing with the following error message
Describe the solution you'd like
It is understandable that proxyinit will execute iptables command to deploy some traffic redirection rules and it requires to run as root user. If this is a hard requirement, I would want the appmesh-controller to inject this as part of container security context. The current injected container security context is
What I would like to see is to look like
The text was updated successfully, but these errors were encountered: