pingcap / pingcap/tidb-operator
I would like to add allowPrivilegeEscalation
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 540
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 18
Description
Env: GKE 1.30.5-gke.1443001
TiDB: 8.4.0
I have try to modify the CRD tidbdashboards.pingcap.com add the securityContext.allowPrivilegeEscalation to initContinaer\ ephemeral\ containerable. After that I could add it on Kind:TidbDashboard and apply successful but still could exec pod tidbdashboard and execute su - .
Here is my tidb-dashboard and crd tidbdashboards.pingcap.com configuration.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the attached tidb.zip and the tidbdashboards.pingcap.com CRD configuration, focusing on the TidbDashboard init, ephemeral, and regular containers. Reproduce the su - behavior using the reported GKE 1.30.5-gke.1443001 and TiDB 8.4.0 environment. Done means the intended allowPrivilegeEscalation setting is accepted and enforced for the relevant containers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100