Set readOnlyRootFilesystem: true on control plane and plugin components
#11142
Comments
|
hey I would like to work on this. it seems pretty simple but i have no experience with helm, I'd appreciate if I can contribute and understand this project |
|
hey @deusxanima , i am interested in this can you assign and guide me. |
alpeb
pushed a commit
that referenced
this issue
Aug 15, 2023
…ster (#11221) Fixes #11142 Signed-off-by: Takumi Sue <[email protected]>
alpeb
added a commit
that referenced
this issue
Aug 16, 2023
This is a release candidate for stable-2.14.0; we encourage you to help trying it out! This edge release contains a number of improvements over the multi-cluster features introduced in the last edge release supporting flat networks. It also hardens the containers security stance by removing write access to the root filesystem. * Enhanced `linkerd multicluster link` to allow clusters to be linked without a gateway ([#11226]) * Added cluster store size gauge metric ([#11256]) * Disabled local traffic policy for remote discovery ([#11257]) * Fixed various innocuous multi-cluster warnings ([#11251], [#11246], [#11253]) * Set `readOnlyRootFilesystem: true` in all the containers, as they don't require write permissions ([#11221]; fixes [#11142]) (thanks @mikutas!)
alpeb
added a commit
that referenced
this issue
Aug 16, 2023
This is a release candidate for stable-2.14.0; we encourage you to help trying it out! This edge release contains a number of improvements over the multi-cluster features introduced in the last edge release supporting flat networks. It also hardens the containers security stance by removing write access to the root filesystem. * Enhanced `linkerd multicluster link` to allow clusters to be linked without a gateway ([#11226]) * Added cluster store size gauge metric ([#11256]) * Disabled local traffic policy for remote discovery ([#11257]) * Fixed various innocuous multi-cluster warnings ([#11251], [#11246], [#11253]) * Set `readOnlyRootFilesystem: true` in all the containers, as they don't require write permissions ([#11221]; fixes [#11142]) (thanks @mikutas!)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
What problem are you trying to solve?
Control Plane, Jaeger injector, and linkerd SMI lack the
readOnlyRootFilesystem: truesetting. This setting defaults to false currently which grants unnecessary write permissions.How should the problem be solved?
Update Helm charts for all mentioned components to explicitly set
readOnlyRootFilesystem: trueas the default for said components.Any alternatives you've considered?
n/a
How would users interact with this feature?
Helm charts
Would you like to work on this feature?
None
The text was updated successfully, but these errors were encountered: