diff --git a/cmd/k8s-operator/deploy/crds/tailscale.com_proxyclasses.yaml b/cmd/k8s-operator/deploy/crds/tailscale.com_proxyclasses.yaml
index 4c24a1633..ad2e8f243 100644
--- a/cmd/k8s-operator/deploy/crds/tailscale.com_proxyclasses.yaml
+++ b/cmd/k8s-operator/deploy/crds/tailscale.com_proxyclasses.yaml
@@ -1384,11 +1384,12 @@ spec:
securityContext:
description: |-
Container security context.
- Security context specified here will override the security context by the operator.
- By default the operator:
- - sets 'privileged: true' for the init container
- - set NET_ADMIN capability for tailscale container for proxies that
- are created for Services or Connector.
+ Security context specified here will override the security context set by the operator.
+ By default the operator sets the Tailscale container and the Tailscale init container to privileged
+ for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
+ You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
+ installing device plugin in your cluster and configuring the proxies tun device to be created
+ by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
type: object
properties:
@@ -1707,11 +1708,12 @@ spec:
securityContext:
description: |-
Container security context.
- Security context specified here will override the security context by the operator.
- By default the operator:
- - sets 'privileged: true' for the init container
- - set NET_ADMIN capability for tailscale container for proxies that
- are created for Services or Connector.
+ Security context specified here will override the security context set by the operator.
+ By default the operator sets the Tailscale container and the Tailscale init container to privileged
+ for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
+ You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
+ installing device plugin in your cluster and configuring the proxies tun device to be created
+ by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
type: object
properties:
diff --git a/cmd/k8s-operator/deploy/manifests/operator.yaml b/cmd/k8s-operator/deploy/manifests/operator.yaml
index f764fc09a..9b90919fb 100644
--- a/cmd/k8s-operator/deploy/manifests/operator.yaml
+++ b/cmd/k8s-operator/deploy/manifests/operator.yaml
@@ -1851,11 +1851,12 @@ spec:
securityContext:
description: |-
Container security context.
- Security context specified here will override the security context by the operator.
- By default the operator:
- - sets 'privileged: true' for the init container
- - set NET_ADMIN capability for tailscale container for proxies that
- are created for Services or Connector.
+ Security context specified here will override the security context set by the operator.
+ By default the operator sets the Tailscale container and the Tailscale init container to privileged
+ for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
+ You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
+ installing device plugin in your cluster and configuring the proxies tun device to be created
+ by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
properties:
allowPrivilegeEscalation:
@@ -2174,11 +2175,12 @@ spec:
securityContext:
description: |-
Container security context.
- Security context specified here will override the security context by the operator.
- By default the operator:
- - sets 'privileged: true' for the init container
- - set NET_ADMIN capability for tailscale container for proxies that
- are created for Services or Connector.
+ Security context specified here will override the security context set by the operator.
+ By default the operator sets the Tailscale container and the Tailscale init container to privileged
+ for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
+ You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
+ installing device plugin in your cluster and configuring the proxies tun device to be created
+ by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
properties:
allowPrivilegeEscalation:
diff --git a/cmd/k8s-operator/deploy/manifests/proxy.yaml b/cmd/k8s-operator/deploy/manifests/proxy.yaml
index 1ad63c265..3c9a3eaa3 100644
--- a/cmd/k8s-operator/deploy/manifests/proxy.yaml
+++ b/cmd/k8s-operator/deploy/manifests/proxy.yaml
@@ -39,6 +39,4 @@ spec:
fieldRef:
fieldPath: metadata.uid
securityContext:
- capabilities:
- add:
- - NET_ADMIN
+ privileged: true
diff --git a/cmd/k8s-operator/testutils_test.go b/cmd/k8s-operator/testutils_test.go
index 8f06f5979..5f016e91d 100644
--- a/cmd/k8s-operator/testutils_test.go
+++ b/cmd/k8s-operator/testutils_test.go
@@ -76,9 +76,7 @@ func expectedSTS(t *testing.T, cl client.Client, opts configOpts) *appsv1.Statef
{Name: "TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR", Value: "/etc/tsconfig"},
},
SecurityContext: &corev1.SecurityContext{
- Capabilities: &corev1.Capabilities{
- Add: []corev1.Capability{"NET_ADMIN"},
- },
+ Privileged: ptr.To(true),
},
ImagePullPolicy: "Always",
}
diff --git a/docs/k8s/proxy.yaml b/docs/k8s/proxy.yaml
index 78e97c83b..048fd7a5b 100644
--- a/docs/k8s/proxy.yaml
+++ b/docs/k8s/proxy.yaml
@@ -53,6 +53,4 @@ spec:
fieldRef:
fieldPath: metadata.uid
securityContext:
- capabilities:
- add:
- - NET_ADMIN
+ privileged: true
diff --git a/docs/k8s/sidecar.yaml b/docs/k8s/sidecar.yaml
index 6baa6d545..520e4379a 100644
--- a/docs/k8s/sidecar.yaml
+++ b/docs/k8s/sidecar.yaml
@@ -35,6 +35,4 @@ spec:
fieldRef:
fieldPath: metadata.uid
securityContext:
- capabilities:
- add:
- - NET_ADMIN
+ privileged: true
diff --git a/docs/k8s/subnet.yaml b/docs/k8s/subnet.yaml
index 1af146be6..ef4e4748c 100644
--- a/docs/k8s/subnet.yaml
+++ b/docs/k8s/subnet.yaml
@@ -37,6 +37,4 @@ spec:
fieldRef:
fieldPath: metadata.uid
securityContext:
- capabilities:
- add:
- - NET_ADMIN
+ privileged: true
diff --git a/k8s-operator/api.md b/k8s-operator/api.md
index 640d8fb07..730bed210 100644
--- a/k8s-operator/api.md
+++ b/k8s-operator/api.md
@@ -145,7 +145,7 @@ _Appears in:_
| `image` _string_ | Container image name. By default images are pulled from
docker.io/tailscale/tailscale, but the official images are also
available at ghcr.io/tailscale/tailscale. Specifying image name here
will override any proxy image values specified via the Kubernetes
operator's Helm chart values or PROXY_IMAGE env var in the operator
Deployment.
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | |
| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#pullpolicy-v1-core)_ | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | Enum: [Always Never IfNotPresent]
|
| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#resourcerequirements-v1-core)_ | Container resource requirements.
By default Tailscale Kubernetes operator does not apply any resource
requirements. The amount of resources required wil depend on the
amount of resources the operator needs to parse, usage patterns and
cluster size.
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources | | |
-| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#securitycontext-v1-core)_ | Container security context.
Security context specified here will override the security context by the operator.
By default the operator:
- sets 'privileged: true' for the init container
- set NET_ADMIN capability for tailscale container for proxies that
are created for Services or Connector.
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context | | |
+| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#securitycontext-v1-core)_ | Container security context.
Security context specified here will override the security context set by the operator.
By default the operator sets the Tailscale container and the Tailscale init container to privileged
for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
installing device plugin in your cluster and configuring the proxies tun device to be created
by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context | | |
| `debug` _[Debug](#debug)_ | Configuration for enabling extra debug information in the container.
Not recommended for production use. | | |
diff --git a/k8s-operator/apis/v1alpha1/types_proxyclass.go b/k8s-operator/apis/v1alpha1/types_proxyclass.go
index 7e408cd0a..71fbf2439 100644
--- a/k8s-operator/apis/v1alpha1/types_proxyclass.go
+++ b/k8s-operator/apis/v1alpha1/types_proxyclass.go
@@ -206,11 +206,12 @@ type Container struct {
// +optional
Resources corev1.ResourceRequirements `json:"resources,omitempty"`
// Container security context.
- // Security context specified here will override the security context by the operator.
- // By default the operator:
- // - sets 'privileged: true' for the init container
- // - set NET_ADMIN capability for tailscale container for proxies that
- // are created for Services or Connector.
+ // Security context specified here will override the security context set by the operator.
+ // By default the operator sets the Tailscale container and the Tailscale init container to privileged
+ // for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
+ // You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
+ // installing device plugin in your cluster and configuring the proxies tun device to be created
+ // by the device plugin, see https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
// +optional
SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`