Stop running auxiliary containers with maximum priveleges #1606
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
dtantsur
force-pushed
the
no-privileged
branch
2 times, most recently
from
629c0af
to
3ce3905
Compare
None of the Metal3 components actually require --privileged. Instead, disable the SELinux isolation to allow the containers to mount host directories. Also don't expose vbmc to the host networking. For this all to work, stop using a pod for these containers. I'm not sure why we even do that in the first place.
dtantsur
force-pushed
the
no-privileged
branch
from
3ce3905
to
819abff
Compare
|
/retest |
1 similar comment
|
/retest |
|
@dtantsur: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
None of the Metal3 components actually require --privileged.
Instead, disable the SELinux isolation to allow the containers
to mount host directories.
Also don't expose sushy-tools and vbmc to the host networking.