mattermost-helm
mattermost-helm copied to clipboard
[CLD-7443] Allow `rtcd` service to be exposed on a privileged port
Summary
PR proposes a possible solution to the issue we are facing when trying to have rtcd
listen on a privileged port (lower than 1024).
So far we've tested a couple of workarounds (full context at https://hub.mattermost.com/private-core/pl/5ubornsmpfnkuyxnmyixgfpich):
- Setting the
NET_BIND_SERVICE
capability in the container security context. - Setting the
net.ipv4.ip_unprivileged_port_start
sysctl in the pod security context.
Unfortunately, none of the above is working, possibly because the image was meant to be run using an unprivileged user at all times.
So I was thinking we could avoid the problem altogether by using the k8s service as designed and let it forward the traffic from privileged (node level) to unprivileged (container level). The only caveat is that to do so we'll need to disable host networking.
This is the bit I will need some guidance on because I don't have a full understanding of other potential side effects of doing so (e.g. DNS policy?).
Note To make this work properly in our deployment we'll also need some changes coming in v0.15.1 (https://github.com/mattermost/rtcd/pull/140).
Ticket Link
https://mattermost.atlassian.net/browse/CLD-7443