kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hardening: Add `SeccompDefault` admission plugin for kubelet (#9074) 

* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates

* fix(kubelet-config): enable config through kubelet_feature_gates

* feat(kubelet): add kubelet_seccomp_default variable
pull/9101/head
Alessio Greggi 2022-07-19 09:50:07 +02:00 committed by GitHub
parent 98c194735c
commit 3ce5458f32
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/hardening.md
View File

@ -83,7 +83,8 @@ kubelet_event_record_qps: 1
kubelet_rotate_certificates: true
kubelet_streaming_connection_idle_timeout: "5m"
kubelet_make_iptables_util_chains: true
kubelet_feature_gates: ["RotateKubeletServerCertificate=true"]
kubelet_feature_gates: ["RotateKubeletServerCertificate=true","SeccompDefault=true"]
kubelet_seccomp_default: true
# additional configurations
kube_owner: root

7
roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
View File

@ -116,9 +116,9 @@ resolvConf: "{{ kube_resolv_conf }}"
{% if inventory_hostname in groups['kube_node'] and kubelet_node_config_extra_args %}
{{ kubelet_node_config_extra_args | to_nice_yaml(indent=2) }}
{% endif %}
{% if kube_feature_gates %}
{% if kubelet_feature_gates or kube_feature_gates %}
featureGates:
{% for feature in kube_feature_gates %}
{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
{{ feature|replace("=", ": ") }}
{% endfor %}
{% endif %}
@ -146,3 +146,6 @@ streamingConnectionIdleTimeout: {{ kubelet_streaming_connection_idle_timeout }}
{% if kubelet_make_iptables_util_chains is defined %}
makeIPTablesUtilChains: {{ kubelet_make_iptables_util_chains | bool }}
{% endif %}
{% if kubelet_seccomp_default is defined %}
seccompDefault: {{ kubelet_seccomp_default | bool }}
{% endif %}