CRI-O: Use localhost for stream server with random port

This should work since it's the default in CRI-O with the merge of cri-o/cri-o#1714. It slightly increases security of the default configuration. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
openshift · Oct 16, 2023 · 7abbec0 · 7abbec0
1 parent 2513389
commit 7abbec0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/templates/master/01-master-container-runtime/_base/files/crio.yaml b/templates/master/01-master-container-runtime/_base/files/crio.yaml
@@ -7,8 +7,8 @@ contents:
     version_file_persist = "/var/lib/crio/version"
 
     [crio.api]
-    stream_address = ""
-    stream_port = "10010"
+    stream_address = "127.0.0.1"
+    stream_port = "0"
 
     [crio.runtime]
     selinux = true

diff --git a/templates/worker/01-worker-container-runtime/_base/files/crio.yaml b/templates/worker/01-worker-container-runtime/_base/files/crio.yaml
@@ -7,8 +7,8 @@ contents:
     version_file_persist = "/var/lib/crio/version"
 
     [crio.api]
-    stream_address = ""
-    stream_port = "10010"
+    stream_address = "127.0.0.1"
+    stream_port = "0"
 
     [crio.runtime]
     selinux = true