github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 14:07:14 +00:00
Code Issues Projects Releases Wiki Activity

add net.ipv4.ip_local_reserved_ports to safe sysctls

Browse Source 
Signed-off-by: Paco Xu <paco.xu@daocloud.io>
This commit is contained in:
Paco Xu 2023-02-01 03:11:58 +08:00
parent 53b8170b97
commit ca4022c4da
3 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/kubelet/sysctl/safe_sysctls.go
View File

@ -28,5 +28,6 @@ func SafeSysctlAllowlist() []string {
"net.ipv4.tcp_syncookies", "net.ipv4.tcp_syncookies",
"net.ipv4.ping_group_range", "net.ipv4.ping_group_range",
"net.ipv4.ip_unprivileged_port_start", "net.ipv4.ip_unprivileged_port_start",
"net.ipv4.ip_local_reserved_ports",
} }
} }

2
staging/src/k8s.io/pod-security-admission/policy/check_sysctls.go
View File

@ -42,6 +42,7 @@ spec.securityContext.sysctls[*].name
'net.ipv4.tcp_syncookies' 'net.ipv4.tcp_syncookies'
'net.ipv4.ping_group_range' 'net.ipv4.ping_group_range'
'net.ipv4.ip_unprivileged_port_start' 'net.ipv4.ip_unprivileged_port_start'
'net.ipv4.ip_local_reserved_ports'
*/ */
@ -71,6 +72,7 @@ var (
"net.ipv4.tcp_syncookies", "net.ipv4.tcp_syncookies",
"net.ipv4.ping_group_range", "net.ipv4.ping_group_range",
"net.ipv4.ip_unprivileged_port_start", "net.ipv4.ip_unprivileged_port_start",
"net.ipv4.ip_local_reserved_ports",
) )
) )

3
staging/src/k8s.io/pod-security-admission/test/fixtures_sysctls.go
View File

@ -41,7 +41,7 @@ func init() {
tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.Sysctls = nil }), tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.Sysctls = nil }),
// sysctls with name="kernel.shm_rmid_forced" ,"net.ipv4.ip_local_port_range" // sysctls with name="kernel.shm_rmid_forced" ,"net.ipv4.ip_local_port_range"
// "net.ipv4.tcp_syncookies", "net.ipv4.ping_group_range", // "net.ipv4.tcp_syncookies", "net.ipv4.ping_group_range",
// "net.ipv4.ip_unprivileged_port_start" // "net.ipv4.ip_unprivileged_port_start", "net.ipv4.ip_local_reserved_ports"
tweak(p, func(p *corev1.Pod) { tweak(p, func(p *corev1.Pod) {
p.Spec.SecurityContext.Sysctls = []corev1.Sysctl{ p.Spec.SecurityContext.Sysctls = []corev1.Sysctl{
{Name: "kernel.shm_rmid_forced", Value: "0"}, {Name: "kernel.shm_rmid_forced", Value: "0"},
@ -49,6 +49,7 @@ func init() {
{Name: "net.ipv4.tcp_syncookies", Value: "0"}, {Name: "net.ipv4.tcp_syncookies", Value: "0"},
{Name: "net.ipv4.ping_group_range", Value: "1 0"}, {Name: "net.ipv4.ping_group_range", Value: "1 0"},
{Name: "net.ipv4.ip_unprivileged_port_start", Value: "1024"}, {Name: "net.ipv4.ip_unprivileged_port_start", Value: "1024"},
{Name: "net.ipv4.ip_local_reserved_ports", Value: "1024 4999"},
} }
}), }),
} }