Do not request NET_ADMIN capability without networking
@@ -43,6 +43,8 @@ const ImagePullPolicyKey = "dev.imagePullPolicy"
const KvmDevice = "devices.kubevirt.io/kvm"
const TunDevice = "devices.kubevirt.io/tun"
+const CAP_NET_ADMIN = "NET_ADMIN"
+
type TemplateService interface {
RenderLaunchManifest(*v1.VirtualMachineInstance) (*k8sv1.Pod, error)
}
@@ -290,6 +292,8 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
// Add ports from interfaces to the pod manifest
ports := getPortsFromVMI(vmi)
+ capabilities := getRequiredCapabilities(vmi)
+
// VirtualMachineInstance target container
container := k8sv1.Container{
Name: "compute",
@@ -300,8 +304,7 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
// Privileged mode is disabled.
Privileged: &privileged,
Capabilities: &k8sv1.Capabilities{
- // NET_ADMIN is needed to set up networking for the VM
- Add: []k8sv1.Capability{"NET_ADMIN"},
+ Add: capabilities,
},
},
Command: command,
@@ -428,6 +431,14 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
return &pod, nil
}
+func getRequiredCapabilities(vmi *v1.VirtualMachineInstance) []k8sv1.Capability {
+ res := []k8sv1.Capability{}
+ if (vmi.Spec.Domain.Devices.AutoattachPodInterface == nil) || (*vmi.Spec.Domain.Devices.AutoattachPodInterface == true) {
+ res = append(res, CAP_NET_ADMIN)
+ }
+ return res
+}
+
func getRequiredResources(vmi *v1.VirtualMachineInstance) k8sv1.ResourceList {
res := k8sv1.ResourceList{}
if (vmi.Spec.Domain.Devices.AutoattachPodInterface == nil) || (*vmi.Spec.Domain.Devices.AutoattachPodInterface == true) {
