Use authbind to bind privileged ports #2894
Conversation
k8s-ci-robot
added
approved
| ln.Close() | ||
| return true | ||
| defer conn.Close() | ||
| return false |
There was a problem hiding this comment.
this function is being called in cmd//nginx/flags.go when Nginx has not started yet, which results in for the dial to fail. And consequently
F0803 14:42:19.694324 5 main.go:72] Port 80 is already in use. Please check the flag --http-port
aledbf
force-pushed
the
authbind
branch
2 times, most recently
from
800d5b5 to
5aa30ed
Compare
k8s-ci-robot
added
size/L
Codecov Report
@@ Coverage Diff @@
## master #2894 +/- ##
==========================================
+ Coverage 47.58% 47.59% +0.01%
==========================================
Files 76 76
Lines 5485 5490 +5
==========================================
+ Hits 2610 2613 +3
- Misses 2540 2541 +1
- Partials 335 336 +1
Continue to review full report at Codecov.
|
aledbf
force-pushed
the
authbind
branch
2 times, most recently
from
b09e161 to
80c14c9
Compare
| @@ -741,7 +741,10 @@ func configureDynamically(pcfg *ingress.Configuration, port int) error { | |||
| backends := make([]*ingress.Backend, len(pcfg.Backends)) | |||
|
|
|||
| for i, backend := range pcfg.Backends { | |||
| service := &apiv1.Service{Spec: backend.Service.Spec} | |||
| var service *apiv1.Service | |||
| if backend.Service != nil { | |||
There was a problem hiding this comment.
What did necessitate this? Is this fixing an actual bug? Maybe add a test case?
There was a problem hiding this comment.
Running e2e tests I saw some errors when Service is nil trying to access the Spec field
| return nil, err | ||
| } | ||
|
|
||
| err = os.Chmod(socket, 0777) |
There was a problem hiding this comment.
Is this needed so Nginx can connect to it?
|
please squash commits, then it's good to go 👍 |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aledbf, ElvinEfendi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What this PR does / why we need it:
Removes the attempt to listen ports in the ingress controller to check if a port is available with a simple connection check and adds authbind as mechanism to listen on privileged ports