Skip to content

add sysctl net.ipv4.ip_unprivileged_port_start 53 #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pacoxu wants to merge 1 commit into from
Closed

add sysctl net.ipv4.ip_unprivileged_port_start 53 #171

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions charts/coredns/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,8 +87,10 @@ isClusterService: true
priorityClassName: ""

# Configure the pod level securityContext.
podSecurityContext: {}

podSecurityContext:
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "53"
Comment on lines +90 to +93
Copy link
Collaborator

@hagaibarel hagaibarel Aug 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should already be covered by https://github.com/coredns/helm/blob/master/charts/coredns/values.yaml#L94C1-L97C25

Copy link
Contributor Author

@pacoxu pacoxu Aug 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an alter way and with the new sysctl, we can remove the NET_BIND_SERVICE capability.

          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL

Copy link
Collaborator

@hagaibarel hagaibarel Aug 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we already have a solution in place for this, I don't think we should make any changes, this works as intended and there's no real value in replacing the capabilities with the sysctls

# Configure SecurityContext for Pod.
# Ensure that required linux capability to bind port number below 1024 is assigned (`CAP_NET_BIND_SERVICE`).
securityContext:
Expand Down