[kubernetes-ingress] Unable to start with unprivileged config about helm-charts

[dkorunic]

This feature was intended for upcoming 1.5 Ingress Controller image. We'll internally discuss if we'll backport required features to 1.4 branch or wait for 1.5 final release and I'll get back to you.

[tbnguyen1407]

Thanks for the info. I also notice a privileged initContainer is created when enabling this config. It would be nice to make it optional for hardened environment.

[dkorunic]

@tbnguyen1407 As much as we would like, it's unavoidable as otherwise Controller can't bind privileged ports. Making it optional would most likely cause people to stumble on privileged ports issue when running unprivileged and we in reality use initContainer just to run a single sysctl.

[tbnguyen1407]

What about binding to unprivileged ports on container by default, while maintaining default ports for Service

• containerPort: 8080/8443
• servicePort: 80/443

I checked some other controllers are using this approach (Kong, Traefik)

[Mo3m3n]

That would probably work @tbnguyen1407 except when using hostNetwork/hostPort configuration where in such case the service layer is usually not used to translate 8080 --> 80 and the connection is made directly to the k8s node.
Although this use case is not a k8s best practice, but still users in such case, and without initContainer, won't be able to run unprivileged mode and keep listening on 80/443.

We have considered other alternatives but they all seem to have their limitations.
Example:

• Using linux capabilities, issue is kubernetes/kubernetes#56374
• Setcap on docker images itself, issue is image won't work with old kernels with Aufs

Anyway users feedback is welcome to have the right compromise.