github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #6170 from olljanat/default-sysctls

Browse Source 
CRI: Support enable_unprivileged_icmp and enable_unprivileged_ports options
This commit is contained in:
Michael Crosby
2021-11-18 11:37:23 -05:00
committed by GitHub
parent a776a27af5 2a81c9f677
commit aa2733c202
4 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/cri/config/config.go
View File

@@ -286,6 +286,17 @@ type PluginConfig struct {
// of being placed under the hardcoded directory /var/run/netns. Changing this setting requires
// that all containers are deleted.
NetNSMountsUnderStateDir bool `toml:"netns_mounts_under_state_dir" json:"netnsMountsUnderStateDir"`
// EnableUnprivilegedPorts configures net.ipv4.ip_unprivileged_port_start=0
// for all containers which are not using host network
// and if it is not overwritten by PodSandboxConfig
// Note that currently default is set to disabled but target change it in future, see:
// https://github.com/kubernetes/kubernetes/issues/102612
EnableUnprivilegedPorts bool `toml:"enable_unprivileged_ports" json:"enableUnprivilegedPorts"`
// EnableUnprivilegedICMP configures net.ipv4.ping_group_range="0 2147483647"
// for all containers which are not using host network, are not running in user namespace
// and if it is not overwritten by PodSandboxConfig
// Note that currently default is set to disabled but target change it in future together with EnableUnprivilegedPorts
EnableUnprivilegedICMP bool `toml:"enable_unprivileged_icmp" json:"enableUnprivilegedICMP"`
}
// X509KeyPairStreaming contains the x509 configuration for streaming