Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Add NET_BIND_SERVICE to the security context in the deployment of Mesh Gateway (NET-6463) into release/1.3.x #3570

Conversation

hc-github-team-consul-core

Backport

This PR is auto-generated from #3549 to be assessed for backporting due to the inclusion of the label backport/1.3.x.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@missylbytes
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: unable to process merge commit: "807c119dc615aed148295111f0f4dce1ef8f6783", automatic backport requires rebase workflow

The below text is copied from the body of the original PR.


Adds the NET_BIND_SERVICE to the security context in the deployment of the Mesh Gateway for the Consul Dataplane container.

This is related to this PR hashicorp/consul-dataplane#238 in the Consul Dataplane
NET-6463

How I've tested this PR

  • Manual testing to see the security context is added to the Consul Dataplane container
kubectl get deployment -n consul consul-consul-mesh-gateway -o yaml
# Below has been edited for brevity
apiVersion: apps/v1
kind: Deployment
metadata:
  name: consul-consul-mesh-gateway
  namespace: consul
spec:
  template:
    spec:
      containers:
        - args:
            - -addresses=consul-consul-server.consul.svc
            - -grpc-port=8502
            - -proxy-service-id-path=/consul/service/proxy-id
            - -ca-certs=/consul/tls/ca/tls.crt
            - -credential-type=login
            - -login-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token
            - -login-auth-method=consul-consul-k8s-component-auth-method
            - -login-partition=default
            - -service-partition=default
            - -log-level=info
            - -log-json=false
          command:
            - consul-dataplane
          image: docker.io/hashicorppreview/consul-dataplane:1.2.5-ubi
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL

How I expect others to test this PR

You cant test this without openshift, just install the branch with MeshGateways enabled and check to see if there is a security context.

Someone else was kind enough to test on Openshift:
image

Checklist

  • Tests added

Overview of commits

…h Gateway (NET-6463) (#3549)

* Add NET_BIND_SERVICE to the security context in the deployment of Mesh Gateway
@missylbytes missylbytes force-pushed the backport/add-netbind-to-mesh-gateway/legally-positive-grizzly branch from 45017db to 2067d74 Compare February 7, 2024 18:27
@missylbytes missylbytes marked this pull request as ready for review February 7, 2024 18:28
@missylbytes missylbytes enabled auto-merge (squash) February 7, 2024 18:28
@missylbytes missylbytes merged commit a01643b into release/1.3.x Feb 7, 2024
24 of 48 checks passed
@missylbytes missylbytes deleted the backport/add-netbind-to-mesh-gateway/legally-positive-grizzly branch February 7, 2024 18:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants