lock-down crio stream-address to localhost-only for kubelet proxying (#…

…530)
kontena · Aug 14, 2018 · 64167a7 · 64167a7
1 parent e97e0cb
commit 64167a7
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/lib/pharos/host/el7/el7.rb b/lib/pharos/host/el7/el7.rb
@@ -52,7 +52,7 @@ def configure_container_runtime
           exec_script(
             'configure-cri-o.sh',
             CRIO_VERSION: Pharos::CRIO_VERSION,
-            CRIO_STREAM_ADDRESS: host.peer_address,
+            CRIO_STREAM_ADDRESS: '127.0.0.1',
             CPU_ARCH: host.cpu_arch.name,
             IMAGE_REPO: cluster_config.image_repository
           )

diff --git a/lib/pharos/host/ubuntu/ubuntu_bionic.rb b/lib/pharos/host/ubuntu/ubuntu_bionic.rb
@@ -42,7 +42,7 @@ def configure_container_runtime
           exec_script(
             'configure-cri-o.sh',
             CRIO_VERSION: Pharos::CRIO_VERSION,
-            CRIO_STREAM_ADDRESS: host.peer_address,
+            CRIO_STREAM_ADDRESS: '127.0.0.1',
             CPU_ARCH: host.cpu_arch.name,
             IMAGE_REPO: cluster_config.image_repository
           )

diff --git a/lib/pharos/host/ubuntu/ubuntu_xenial.rb b/lib/pharos/host/ubuntu/ubuntu_xenial.rb
@@ -42,7 +42,7 @@ def configure_container_runtime
           exec_script(
             'configure-cri-o.sh',
             CRIO_VERSION: Pharos::CRIO_VERSION,
-            CRIO_STREAM_ADDRESS: host.peer_address,
+            CRIO_STREAM_ADDRESS: '127.0.0.1',
             CPU_ARCH: host.cpu_arch.name,
             IMAGE_REPO: cluster_config.image_repository
           )