<p>I'm working in kube-proxy development and I'm in the stage of understanding the purpose and execution of kube-proxy. </p>

<p>I know that kube-proxy will add iptables rules to enable user to access the exposed pods (which is kubernetes service in iptables mode). </p>

<p>what makes me wonder, is the fact that those rules are added in the host node where a pod of kube-proxy is running, and it's not clear how this pod is capable of accessing those privileges on the host node. </p>

<p>I have took a look on the code of kubernetes with no success to find this specific part, so if you have any idea, resource, or documentation that would help me to figure this out it would be appreciated. </p>

<p><a href="https://github.com/philips/real-world-kubernetes/blob/master/k8s-setup/kube-proxy.yaml" rel="nofollow noreferrer">kube-proxy.yaml</a></p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: kube-proxy
  namespace: kube-system
spec:
  hostNetwork: true
  containers:
  - name: kube-proxy
    image: gcr.io/google_containers/hyperkube:v1.0.6
    command:
    - /hyperkube
    - proxy
    - --master=http://127.0.0.1:8080
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ssl-certs-host
      readOnly: true
  volumes:
  - hostPath:
      path: /usr/share/ca-certificates
    name: ssl-certs-host
</code></pre>

<p>According to <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">Pod Security Policies</a> document:</p>

<blockquote>
  <p><strong>Privileged</strong> - determines if any container in a pod can enable privileged mode. By default a container is not allowed to access any devices on the host, but a “privileged” container is given access to all devices on the host. This allows the container nearly all the same access as processes running on the host. This is useful for containers that want to use linux capabilities like manipulating the network stack and accessing devices.</p>
</blockquote>

<p>In other words, it gives the container or the pod (depending on a <a href="https://kubernetes-v1-4.github.io/docs/user-guide/security-context/" rel="nofollow noreferrer">context</a>) most of the  root privileges. </p>

<p>There are many more options to control pods capabilities in the securityContext section:</p>

<ul>
<li>Privilege escalation</li>
<li>Linux Capabilities</li>
<li>SELinux</li>
<li>Volumes</li>
<li>Users and groups</li>
<li>Networking</li>
</ul>

<p>Consider reading the full <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">article</a> for details and code snippets.</p>
