Skip privileged ports when building listeners for non-root gateways

See: istio/istio#28268
banzaicloud · Feb 22, 2021 · 2faea4b · 2faea4b
1 parent 4b1ee69
commit 2faea4b
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/pkg/resources/gateways/deployment.go b/pkg/resources/gateways/deployment.go
@@ -286,6 +286,13 @@ func (r *Reconciler) envVars() []apiv1.EnvVar {
 		},
 	}...)
 
+	if !util.PointerToBool(r.gw.Spec.RunAsRoot) {
+		envVars = append(envVars, apiv1.EnvVar{
+			Name:  "ISTIO_META_UNPRIVILEGED_POD",
+			Value: "true",
+		})
+	}
+
 	if util.PointerToBool(r.Config.Spec.Pilot.SPIFFE.OperatorEndpoints.Enabled) {
 		envVars = append(envVars, apiv1.EnvVar{
 			Name:  "TRUSTBUNDLE_MANAGER",