Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't use privileged for targetless agent containers #3041

Merged
merged 5 commits into from
Jan 28, 2025
+15 −9
Merged

Don't use privileged for targetless agent containers #3041

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
be0797e
Removed security context from targetless agents
Razz4780 Jan 28, 2025
693dc5b
Updated schema and configuration.md
Razz4780 Jan 28, 2025
96fbc3a
Changelog fixed
Razz4780 Jan 28, 2025
8f1647e
fmt
Razz4780 Jan 28, 2025
4dbdcfd
Fix UT
Razz4780 Jan 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/+targetless-privileged.fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
mirrord no longer requires targetless agents' pods to be privileged.
Razz4780 marked this conversation as resolved.
Show resolved Hide resolved
4 changes: 2 additions & 2 deletions mirrord-schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@
},
"disabled_capabilities": {
"title": "agent.disabled_capabilities {#agent-disabled_capabilities}",
"description": "Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`.",
"description": "Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`.\n\nHas no effect when using the targetless mode, as targetless agent containers have no capabilities.",
"type": [
"array",
"null"
Expand Down Expand Up @@ -423,7 +423,7 @@
},
"privileged": {
"title": "agent.privileged {#agent-privileged}",
"description": "Run the mirror agent as privileged container. Defaults to `false`.\n\nMight be needed in strict environments such as Bottlerocket.",
"description": "Run the mirror agent as privileged container. Defaults to `false`.\n\nMight be needed in strict environments such as Bottlerocket.\n\nHas no effect when using the targetless mode, as targetless agent containers are never privileged.",
"type": [
"boolean",
"null"
Expand Down
6 changes: 6 additions & 0 deletions mirrord/config/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,9 @@ Disables specified Linux capabilities for the agent container.
If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and
`SYS_ADMIN`.

Has no effect when using the targetless mode,
as targetless agent containers have no capabilities.

### agent.dns {#agent-dns}

### agent.ephemeral {#agent-ephemeral}
Expand Down Expand Up @@ -355,6 +358,9 @@ Defaults to `false`.

Might be needed in strict environments such as Bottlerocket.

Has no effect when using the targetless mode,
as targetless agent containers are never privileged.

### agent.resources {#agent-resources}

Set pod resource reqirements. (not with ephemeral agents)
Expand Down
6 changes: 6 additions & 0 deletions mirrord/config/src/agent.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,9 +233,12 @@

/// ### agent.disabled_capabilities {#agent-disabled_capabilities}
///
/// Disables specified Linux capabilities for the agent container.

Check warning on line 236 in mirrord/config/src/agent.rs

View workflow job for this annotation

GitHub Actions / lint 

Diff in /home/runner/work/mirrord/mirrord/mirrord/config/src/agent.rs
/// If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and
/// `SYS_ADMIN`.
///
/// Has no effect when using the targetless mode,
/// as targetless agent containers have no capabilities.
pub disabled_capabilities: Option<Vec<LinuxCapability>>,

/// ### agent.tolerations {#agent-tolerations}
Expand Down Expand Up @@ -288,9 +291,12 @@
/// ### agent.privileged {#agent-privileged}
///
/// Run the mirror agent as privileged container.
/// Defaults to `false`.

Check warning on line 294 in mirrord/config/src/agent.rs

View workflow job for this annotation

GitHub Actions / lint 

Diff in /home/runner/work/mirrord/mirrord/mirrord/config/src/agent.rs
///
/// Might be needed in strict environments such as Bottlerocket.
///
/// Has no effect when using the targetless mode,
/// as targetless agent containers are never privileged.
#[config(default = false)]
pub privileged: bool,

Expand Down
4 changes: 0 additions & 4 deletions mirrord/kube/src/api/container/pod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,10 +134,6 @@ impl ContainerVariant for PodVariant<'_> {
env: Some(env),
// Add requests to avoid getting defaulted https://github.com/metalbear-co/mirrord/issues/579
resources: Some(resources),
security_context: Some(SecurityContext {
privileged: Some(agent.privileged),
..Default::default()
}),
..Default::default()
}],
..Default::default()
Expand Down
Loading