Run kube-proxy in non-privileged mode for Kubernetes >= 1.29

[ialidzhikov]

How to categorize this issue?

/area security
/kind enhancement

What would you like to be added:
When I worked on the topic about running Pods in non-privileged mode, for kube-proxy I created kubernetes/kubernetes#112171. kubernetes/kubernetes#112171 is fixed by kubernetes/kubernetes#120864. Starting Kubernetes 1.29 it will be possible to run the long-running kube-proxy container as non-privileged.
For more details, see kubernetes/contributor-site#452.

The kube-proxy logic that requires to run in a privileged container is moved to an init container. From kubernetes/kubernetes#120864:

initContainers:
  - name: kube-proxy-init
    command:
    - /usr/local/bin/kube-proxy
    - --config=/var/lib/kube-proxy/config.conf
    - --init-only
    image: registry.k8s.io/kube-proxy:local
    imagePullPolicy: IfNotPresent
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /var/lib/kube-proxy
      name: kube-proxy

And the main kube-proxy container runs with:

        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_RESOURCE"]

Why is this needed:
To run kube-proxy in non-privileged mode.

cc @dimityrmirchev @AleksandarSavchev

[uablrek]

@ialidzhikov I have tested both ipvs and iptables with NET_ADMIN only, and it seems to work. Is there any case I have missed that requires SYS_RESOURCE ?

[shafeeqes]

/assign

[ialidzhikov]

@ialidzhikov I have tested both ipvs and iptables with NET_ADMIN only, and it seems to work. Is there any case I have missed that requires SYS_RESOURCE ?

See #9000 (comment). SYS_RESOURCE seems to be required. According to kubernetes/kubernetes#112171 (comment), SYS_RESOURCE was also required.