External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-05-07 17:37:39 -02:30
Code Issues Packages Projects Releases Wiki Activity

feat: add kubelet systemd service hardening option (#9194)

Browse Source 
* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
This commit is contained in:
Alessio Greggi
2022-08-30 20:18:55 +02:00
committed by GitHub
parent 220f149299
commit acb6f243fd
5 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
roles/kubernetes/node/templates/kubelet.service.j2
View File

@@ -24,6 +24,11 @@ ExecStart={{ bin_dir }}/kubelet \
$KUBELET_CLOUDPROVIDER
Restart=always
RestartSec=10s
{% if kubelet_systemd_hardening %}
# Hardening setup
IPAddressDeny=any
IPAddressAllow={{ kubelet_secure_addresses }}
{% endif %}
[Install]
WantedBy=multi-user.target