Skip to content

K
k3s
Unverified Commit 7ee5729e authored by Nico Berlee's avatar Nico Berlee
Browse files
Options

Run CoreDNS container only with CAP_NET_BIND_SERVICE, drop all other (root) privileges.

Run filesystem of container and config in read-only mode.
parent d373eaa4
Hide whitespace changes
Inline Side-by-side
Showing with 36 additions and 0 deletions
cluster/addons/dns/coredns/coredns.yaml.base
View file @ 7ee5729e
......@@ -118,6 +118,7 @@ spec:
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
......@@ -137,6 +138,14 @@ spec:
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
......
cluster/addons/dns/coredns/coredns.yaml.in
View file @ 7ee5729e
......@@ -118,6 +118,7 @@ spec:
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
......@@ -137,6 +138,14 @@ spec:
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
......
cluster/addons/dns/coredns/coredns.yaml.sed
View file @ 7ee5729e
......@@ -118,6 +118,7 @@ spec:
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
......@@ -137,6 +138,14 @@ spec:
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
......
cmd/kubeadm/app/phases/addons/dns/manifests.go
View file @ 7ee5729e
......@@ -259,6 +259,7 @@ spec:
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
......@@ -278,6 +279,14 @@ spec:
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment