diff --git a/octavia/templates/daemonset-health-manager.yaml b/octavia/templates/daemonset-health-manager.yaml index 3f1f69fe60..06afc18e74 100644 --- a/octavia/templates/daemonset-health-manager.yaml +++ b/octavia/templates/daemonset-health-manager.yaml @@ -76,11 +76,7 @@ spec: - name: octavia-health-manager-nic-init {{ tuple $envAll "openvswitch_vswitchd" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.health_manager | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} - securityContext: - runAsUser: 0 - capabilities: - add: - - NET_ADMIN +{{ dict "envAll" $envAll "application" "octavia_health_manager" "container" "octavia_health_manager_nic_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/octavia-health-manager-nic-init.sh volumeMounts: @@ -96,11 +92,7 @@ spec: - name: octavia-health-manager {{ tuple $envAll "octavia_health_manager" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.health_manager | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} - securityContext: - runAsUser: 0 - capabilities: - add: - - NET_ADMIN +{{ dict "envAll" $envAll "application" "octavia_health_manager" "container" "octavia_health_manager" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/octavia-health-manager.sh - start diff --git a/octavia/values.yaml b/octavia/values.yaml index fc5605cce2..d1d2350208 100644 --- a/octavia/values.yaml +++ b/octavia/values.yaml @@ -590,6 +590,20 @@ pod: container: octavia_housekeeping: runAsUser: 42424 + octavia_health_manager: + container: + octavia_health_manager_nic_init: + runAsUser: 0 + capabilities: + add: + - NET_ADMIN + - NET_RAW + - NET_BIND_SERVICE + octavia_health_manager: + runAsUser: 0 + capabilities: + add: + - NET_ADMIN affinity: anti: type: diff --git a/releasenotes/notes/octavia-health-manager-net-caps-49adc645e1d03456.yaml b/releasenotes/notes/octavia-health-manager-net-caps-49adc645e1d03456.yaml new file mode 100644 index 0000000000..a5c5b993f5 --- /dev/null +++ b/releasenotes/notes/octavia-health-manager-net-caps-49adc645e1d03456.yaml @@ -0,0 +1,11 @@ +--- +# To create a new release note related to a specific chart: +# reno new +# +# To create a new release note for a common change (when multiple charts +# are changed): +# reno new common +octavia: + - | + Health manager requires NET_RAW and NET_BIND_SERVICE for allowing ISC DHCPD to work +...