Merge pull request #64473 from nberlee/master

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Drop capabilities of CoreDNS container and run in read-only **What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: Same [changes](https://github.com/coredns/deployment/commit/aba0245609821e8bba8b4ecd6a32c1a02a7bf658) as in the CoreDNS deployment repository. **Release note**: ```release-note Kubeadm: Make CoreDNS run in read-only mode and drop all unneeded privileges ```

Merge pull request #64473 from nberlee/master
2f011d01 · Kubernetes Submit Queue · GitHub · c178c7fd · 7ee5729e · 2f011d01
Unverified Commit 2f011d01 authored Jun 05, 2018 by Kubernetes Submit Queue Committed by GitHub Jun 05, 2018
4 changed files
--- a/cluster/addons/dns/coredns/coredns.yaml.base
+++ b/cluster/addons/dns/coredns/coredns.yaml.base
@@ -118,6 +118,7 @@ spec:
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
+          readOnly: true
        ports:
        - containerPort: 53
          name: dns
@@ -137,6 +138,14 @@ spec:
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - all
+          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume

--- a/cluster/addons/dns/coredns/coredns.yaml.in
+++ b/cluster/addons/dns/coredns/coredns.yaml.in
@@ -118,6 +118,7 @@ spec:
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
+          readOnly: true
        ports:
        - containerPort: 53
          name: dns
@@ -137,6 +138,14 @@ spec:
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - all
+          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume

--- a/cluster/addons/dns/coredns/coredns.yaml.sed
+++ b/cluster/addons/dns/coredns/coredns.yaml.sed
@@ -118,6 +118,7 @@ spec:
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
+          readOnly: true
        ports:
        - containerPort: 53
          name: dns
@@ -137,6 +138,14 @@ spec:
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - all
+          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume

--- a/cmd/kubeadm/app/phases/addons/dns/manifests.go
+++ b/cmd/kubeadm/app/phases/addons/dns/manifests.go
@@ -259,6 +259,7 @@ spec:
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
+          readOnly: true
        ports:
        - containerPort: 53
          name: dns
@@ -278,6 +279,14 @@ spec:
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - all
+          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume