Envoy allowPrivilegeEscalation. Is it needed?

Consul
1

Hello Team, I have a query.

Does envoy docker image used in the service mesh need privilege escalation ? I have been following up on latest beta releases for consul-k8s and I see that security context is enforced but privilege escalation is still allowed.

reference: consul-k8s/CHANGELOG.md at master · hashicorp/consul-k8s · GitHub

We have a security policy implemented in our k8s cluster that do not allow any containers to run in allow privilege escalation mode.

Can someone clarify if allow privilege escalation is needed or not ? If needed then in what circumstances that would be needed ?

Thanks

2

Hi @ashwinkupatkar! The priv escalation is required so that we can execute iptables commands inside the init container for transparent proxy. This runs as an init container and exits before the application starts so it should be less of a risk than if it were a long running task.

If you are not using tproxy then it will not add any additional privs.

1 Like
3

thanks for the reply @kschoche. I understand it.

by tproxy you mean Transparent Proxy ?

another query - When are we expecting a GA for consul-k8s-0.26.0 ?

4

Sorry for the confusion, I meant transparent proxy! :slight_smile:

We don’t have a public release date yet but are targeting in the next month or so.

1 Like
5

Hi @ashwinkupatkar 0.26.0 was just released!

1 Like
6

Thats lovely to hear @kschoche . Thanks for posting me the update.

1 Like