Skip NET_RAW & NET_ADMIN while copying pod drop capabilities.
* Skip NET_RAW & NET_ADMIN while copying pod drop capabilities.
While copying the container drop capabilites into the sidecars we should
skip NET_RAW and NET_ADMIN as the init containers require them to setup
iptables.
@@ -663,7 +663,19 @@ func (conf *ResourceConfig) injectPodSpec(values *podPatch) {
func (conf *ResourceConfig) injectProxyInit(values *podPatch) {
// Fill common fields from Proxy into ProxyInit
- values.ProxyInit.Capabilities = values.Proxy.Capabilities
+ if values.Proxy.Capabilities != nil {
+ values.ProxyInit.Capabilities = &l5dcharts.Capabilities{}
+ values.ProxyInit.Capabilities.Add = values.Proxy.Capabilities.Add
+ values.ProxyInit.Capabilities.Drop = []string{}
+ for _, drop := range values.Proxy.Capabilities.Drop {
+ // Skip NET_RAW and NET_ADMIN as the init container requires them to setup iptables.
+ if drop == "NET_RAW" || drop == "NET_ADMIN" {
+ continue
+ }
+ values.ProxyInit.Capabilities.Drop = append(values.ProxyInit.Capabilities.Drop, drop)
+ }
+ }
+
values.ProxyInit.SAMountPath = values.Proxy.SAMountPath
if v := conf.pod.meta.Annotations[k8s.CloseWaitTimeoutAnnotation]; v != "" {
