Fix port binding with reduced privileges #3574
Merged
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Problem: The nginx deployment was using extra privileges in order to bind to privileged ports (<1024). This included
allowPrivilegeEscalation
andNET_BIND_SERVICE
. Sometimes this could cause issues in some secure environments.Solution: Remove these extra privileges and take advantage of
sysctls
to lower the allowed port range for the pod its defined on.Testing: Verified that everything still works, including in OpenShift.
Closes #3567
Checklist
Before creating a PR, run through this checklist and mark each as complete.
Release notes
If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.