Allow privilege escalation for dnsmasq

metal3-io · Dec 1, 2023 · 7a905af · 7a905af
1 parent 5587ad0
commit 7a905af
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/pkg/ironic/containers.go b/pkg/ironic/containers.go
@@ -384,8 +384,9 @@ func newDnsmasqContainer(ironic *metal3api.Ironic) corev1.Container {
 		Command: []string{"/bin/rundnsmasq"},
 		Env:     envVars,
 		SecurityContext: &corev1.SecurityContext{
-			RunAsUser:  pointer.Int64(ironicUser),
-			RunAsGroup: pointer.Int64(ironicGroup),
+			RunAsUser:                pointer.Int64(ironicUser),
+			RunAsGroup:               pointer.Int64(ironicGroup),
+			AllowPrivilegeEscalation: pointer.Bool(true),
 			Capabilities: &corev1.Capabilities{
 				Drop: []corev1.Capability{"ALL"},
 				Add:  []corev1.Capability{"NET_ADMIN", "NET_BIND_SERVICE", "NET_RAW"},