From 99307b0f851fef545cf74b43a00c942f675e4fe5 Mon Sep 17 00:00:00 2001 From: Martin Matyas Date: Fri, 16 Oct 2026 20:21:06 +0200 Subject: [PATCH] fix(helm): run eUPF as a non-root user by default The image carries the capabilities eUPF needs as file capabilities, so the chart's default security context now runs the container as uid 1000 with NET_ADMIN, SYS_RESOURCE, BPF, PERFMON and DAC_OVERRIDE, and no SYS_ADMIN: a non-root entrypoint mounts nothing, and the kernels the chart supports have CAP_BPF. Only the node's bpffs is mounted into the pod, at /sys/fs/bpf, instead of all of /sys. Needs an appVersion whose image has the file capabilities, and bpffs mounted on the nodes. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Martin Matyas --- .deploy/helm/eupf/values.yaml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.deploy/helm/eupf/values.yaml b/.deploy/helm/eupf/values.yaml index df2bf30d..06cf2f9a 100644 --- a/.deploy/helm/eupf/values.yaml +++ b/.deploy/helm/eupf/values.yaml @@ -100,19 +100,18 @@ configMaps: {} # foo: bar # volumes. -# The /sys hostPath volume is required: as root, the container entrypoint -# mounts bpffs and debugfs under /sys to load the eBPF data plane; as a -# non-root user (see securityContext) eUPF uses the node's bpffs through it. +# The node's BPF filesystem, where eUPF pins its maps. Only bpffs is needed +# as a non-root user; a root container that mounts bpffs and debugfs itself +# (the entrypoint does, when root) needs /sys instead. volumes: - name: sys hostPath: - path: /sys + path: /sys/fs/bpf # volume mounts volumeMounts: - name: sys - mountPath: /sys - readOnly: true + mountPath: /sys/fs/bpf hostNetwork: false @@ -251,8 +250,11 @@ podSecurityContext: # capabilities: # add: [NET_ADMIN, SYS_RESOURCE, BPF, PERFMON, DAC_OVERRIDE] securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true capabilities: - add: [NET_ADMIN, SYS_ADMIN, SYS_RESOURCE, BPF, PERFMON] + add: [NET_ADMIN, SYS_RESOURCE, BPF, PERFMON, DAC_OVERRIDE] extraContainerPorts: - name: metrics