From c8ec77a7344e8e05d2728ddcbdea7b17e92610f6 Mon Sep 17 00:00:00 2001
From: Fredrik Liv <fredrik.liv@elastisys.com>
Date: Fri, 9 Dec 2022 15:16:12 +0100
Subject: [PATCH] [containerd] Add config for unpriviledged ports and icmp
(#9517)
* [containerd] Add config for unpriviledged ports and icmp
* Updated to match true false variables of other setting
---
roles/container-engine/containerd/defaults/main.yml | 5 +++++
roles/container-engine/containerd/templates/config.toml.j2 | 2 ++
2 files changed, 7 insertions(+)
diff --git a/roles/container-engine/containerd/defaults/main.yml b/roles/container-engine/containerd/defaults/main.yml
index a5ef23637..83115c4fa 100644
--- a/roles/container-engine/containerd/defaults/main.yml
+++ b/roles/container-engine/containerd/defaults/main.yml
@@ -52,6 +52,11 @@ containerd_registries:
containerd_max_container_log_line_size: -1
+# If enabled it will allow non root users to use port numbers <1024
+containerd_enable_unprivileged_ports: false
+# If enabled it will allow non root users to use icmp sockets
+containerd_enable_unprivileged_icmp: false
+
containerd_cfg_dir: /etc/containerd
# Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
diff --git a/roles/container-engine/containerd/templates/config.toml.j2 b/roles/container-engine/containerd/templates/config.toml.j2
index 7ffe37045..c1bda12b8 100644
--- a/roles/container-engine/containerd/templates/config.toml.j2
+++ b/roles/container-engine/containerd/templates/config.toml.j2
@@ -18,6 +18,8 @@ oom_score = {{ containerd_oom_score }}
[plugins."io.containerd.grpc.v1.cri"]
sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
max_container_log_line_size = {{ containerd_max_container_log_line_size }}
+ enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | default(false) | lower }}
+ enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | default(false) | lower }}
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "{{ containerd_default_runtime | default('runc') }}"
snapshotter = "{{ containerd_snapshotter | default('overlayfs') }}"
--
GitLab