Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Run as non-root user on kubernetes #56

Open
ebarped opened this issue Oct 25, 2021 · 1 comment
Open

Run as non-root user on kubernetes #56

ebarped opened this issue Oct 25, 2021 · 1 comment
Assignees
@czerwonk

Comments

@ebarped
Copy link
Contributor

ebarped commented Oct 25, 2021 •
edited

Hi!

Im trying to run this exporter on kubernetes without being a root user.

Currently, i can at least execute it as root but with dropped capabilities:

securityContext:
  capabilities:
    drop:
      - all
    add: ["NET_RAW"]

But when i change to a non-root user, with the following securityContext:

securityContext:
  runAsUser: 65534
  runAsNonRoot: true
  capabilities:
    drop:
      - all
    add: ["NET_RAW"]

it fails with:
ERRO[0000] cannot start monitoring: listen ip4:icmp 0.0.0.0: socket: operation not permitted

I have tried to add more capabilities (NET_ADMIN, SYS_ADMIN) without success.
@drTr0jan
Copy link
Contributor

drTr0jan commented Jul 1, 2022

The problem is here: Pinger.New() can only create privileged icmp.PacketConn

@czerwonk czerwonk self-assigned this Jul 1, 2022
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this issue Jul 14, 2022
@drTr0jan @nunotexbsd
net-mgmt/ping_exporter: Update to 1.0.0
c15d387 
 - Switched to GO_MODULE
 - Fixed "Run as non-root user"
( czerwonk/ping_exporter#56 ) by setuid bit
 - Added ping_exporter_syslog_output_* params to rc-script for syslog
   output tuning

ChangeLog:
https://github.com/czerwonk/ping_exporter/releases/tag/1.0.0

PR:		264048
Approved by:	maintainer timeout > 1 month
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@czerwonk czerwonk

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@czerwonk @drTr0jan @ebarped