Comments (5)
This feature was intended for upcoming 1.5 Ingress Controller image. We'll internally discuss if we'll backport required features to 1.4 branch or wait for 1.5 final release and I'll get back to you.
from helm-charts.
Thanks for the info. I also notice a privileged initContainer is created when enabling this config. It would be nice to make it optional for hardened environment.
from helm-charts.
@tbnguyen1407 As much as we would like, it's unavoidable as otherwise Controller can't bind privileged ports. Making it optional would most likely cause people to stumble on privileged ports issue when running unprivileged and we in reality use initContainer just to run a single sysctl.
from helm-charts.
What about binding to unprivileged ports on container by default, while maintaining default ports for Service
- containerPort: 8080/8443
- servicePort: 80/443
I checked some other controllers are using this approach (Kong, Traefik)
from helm-charts.
That would probably work @tbnguyen1407 except when using hostNetwork/hostPort configuration where in such case the service layer is usually not used to translate 8080 --> 80 and the connection is made directly to the k8s node.
Although this use case is not a k8s best practice, but still users in such case, and without initContainer, won't be able to run unprivileged mode and keep listening on 80/443.
We have considered other alternatives but they all seem to have their limitations.
Example:
- Using linux capabilities, issue is kubernetes/kubernetes#56374
- Setcap on docker images itself, issue is image won't work with old kernels with Aufs
Anyway users feedback is welcome to have the right compromise.
from helm-charts.
Related Issues (20)
- crdjob-1 : ttlSecondAfterFinish property delete the job after 120 seconds HOT 4
- Helm upgrade failed due to Job resource HOT 2
- Default certificate does not exist HOT 10
- binding to privileged port fail HOT 13
- No access possible in local docker desktop installation HOT 6
- nodeselector not working as expected HOT 1
- Graceful Termination Of Kubernetes Ingress Pods HOT 1
- External IP is never assigned to LoadBalancer service for 1.38.0 HOT 1
- [BUG] Controller service spec invalid due to multiple protocols HOT 2
- Default ports are not getting removed when passed as null from Parent chart
- Allow setting resources requests or limits on crdjob HOT 2
- missing https 443 container port HOT 2
- CRDJob Continually Runs HOT 1
- Allow setting pod security-context in kubernetes-ingress for rootless 80/443 HOT 4
- Probes port 1042 typo? HOT 1
- preStop hook fails (in log) HOT 2
- Not able to setup retry-on functionality globally, I tried multiple values.yaml ! Please correct me if i am wrong ! HOT 1
- Not able to set custom error pages on the response of 404 and 503 ! Tried Configmaps and Values.yaml ! HOT 2
- It would be interesting to be able to introduce additional metadata labels in the deployments and statefulsets HOT 2
- ServiceMonitor is not creating HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from helm-charts.