Skip to content

Add "NET_RAW" to ironic-endpoint-keepalived #782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
metal3-io-bot merged 1 commit into from
Feb 1, 2021
Merged

Add "NET_RAW" to ironic-endpoint-keepalived #782

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ironic-deployment/keepalived/keepalived_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ spec:
name: ironic-endpoint-keepalived
securityContext:
capabilities:
add: ["NET_ADMIN"]
add: ["NET_ADMIN", "NET_RAW"]
Copy link
Copy Markdown
Member

@furkatgofurov7 furkatgofurov7 Jan 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any other alternative to avoid adding this capability in order to fix the issue with ironic-endpoint? The reason I was curious is mainly that this might be a security flaw.

Copy link
Copy Markdown
Member

@kashifest kashifest Feb 1, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@furkatgofurov7 I am having difficulty understanding how adding these two capabilities is a security flaw, Yes you should not add these capabilities to untrusted containers, but for your own trusted containers, if you dont add them and if your container needs them, it will simply not work.

Copy link
Copy Markdown
Member

@furkatgofurov7 furkatgofurov7 Feb 1, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I was not sure, if this is in the context of untrusted containers, my understanding was, it can be any container.

envFrom:
- configMapRef:
name: ironic-bmo-configmap
name: ironic-bmo-configmap