Security

Container privileges

The Listener Operator runs as a set of root containers. This is needed for two reasons:

  1. We need to run as root to have permission to create the Unix domain socket hosting the Container Storage interface (CSI) driver. The Kubelet communicates with the CSI driver over this socket.

  2. We need to run as root to have permission to write information about externally exposed addresses into the pods' volume paths, as directed by the CSI.

Running as root is currently a hard requirement.