Closed langesven closed 4 years ago
@langesven thanks for raising this and giving such a thorough analysis! I like the idea of using the targetPort to avoid having to have the proxy listen on a privileged port. I can't think of an out-of-the-box workaround at present, but will ensure this gets resolved soon.
I started playing around with skupper today and so far it's pretty nice. One thing I noticed where I run into problems is the following scenario
I have a service in one of my clusters that is running on port 80 and also exposing port 80
which in turn leads to skupper on a different site creating the respective service and proxy deployment
but since the pod runs as non-root but tries to bind port 80 this fails with
If I modify the deployment to add
runAsUser: 0
it works, but that's a manual process where I'm not even sure it will stick after some reconciler plows through everything.One idea could be to not bind to privileged ports but rather pick a high port at random and just use port/targetPort on the service to expose the "real" port without having to run the proxy pod as root? Or does anyone have a better idea/maybe I missed some workaround that would allow for this out of the box?