Replace privileged with specific CAPABILITIES requests (#514 )

Disable telemetry by env var MIZU_DISABLE_TELEMTRY (#517 )
2026-04-27 12:56:40 +00:00 · 2021-12-02 11:41:13 +02:00 · 2021-12-02 09:20:27 +02:00
2 changed files with 15 additions and 1 deletions
--- a/cli/telemetry/telemetry.go
+++ b/cli/telemetry/telemetry.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"os"

 	"github.com/denisbrodbeck/machineid"
 	"github.com/up9inc/mizu/cli/apiserver"
@@ -62,6 +63,9 @@ func ReportAPICalls(apiProvider *apiserver.Provider) {
 }

 func shouldRunTelemetry() bool {
+	if _, present := os.LookupEnv("MIZU_DISABLE_TELEMTRY"); present {
+		return false
+	}
 	if !config.Config.Telemetry {
 		return false
 	}
--- a/shared/kubernetes/provider.go
+++ b/shared/kubernetes/provider.go
@@ -651,7 +651,17 @@ func (provider *Provider) ApplyMizuTapperDaemonSet(ctx context.Context, namespac
 	agentContainer.WithName(tapperPodName)
 	agentContainer.WithImage(podImage)
 	agentContainer.WithImagePullPolicy(imagePullPolicy)
-	agentContainer.WithSecurityContext(applyconfcore.SecurityContext().WithPrivileged(true))
+
+	caps := applyconfcore.Capabilities().WithDrop("ALL").WithAdd("NET_RAW").WithAdd("NET_ADMIN")
+	
+	if istio {
+		caps = caps.WithAdd("SYS_ADMIN") // for reading /proc/PID/net/ns
+		caps = caps.WithAdd("SYS_PTRACE") // for setting netns to other process
+		caps = caps.WithAdd("DAC_OVERRIDE") // for reading /proc/PID/environ
+	}
+	
+	agentContainer.WithSecurityContext(applyconfcore.SecurityContext().WithCapabilities(caps))
+
 	agentContainer.WithCommand(mizuCmd...)
 	agentContainer.WithEnv(
 		applyconfcore.EnvVar().WithName(shared.LogLevelEnvVar).WithValue(logLevel.String()),
Author	SHA1	Message	Date
David Levanon	296e1bb667	Replace `privileged` with specific CAPABILITIES requests (#514 )	2021-12-02 11:41:13 +02:00
Igor Gov	2910611111	Disable telemetry by env var MIZU_DISABLE_TELEMTRY (#517 )	2021-12-02 09:20:27 +02:00