Add pod security context from func.yaml #2108
Comments
|
Agreed on both suggestions. I'll add this to our roadmap as a "ready to work" item. |
lkingland
added
the
kind/good-first-issue
|
Hello @zalsader! I'd like to work on this issue. Could you share some more context about how the func.yaml file is leveraged to generate the service definition? Perhaps pointing to the source code files would help too! This is my first issue and would love to contribute here! |
|
@gouthamhusky Sure, yeah. Looking at existing closed PRs is a good first step. For example, my first contribution to the library was to add pvc to the allowed volume options. I am happy to review any PRs you create. I'm not a maintainer, so those people could provide more guidance. |
|
hey @zalsader after digging into this issue I found out that the podSecurityContext is getting set from here - func/pkg/k8s/persistent_volumes.go Line 121 in d2fb76c and the func/pkg/k8s/security_context.go Line 11 in d2fb76c func defaultPodSecurityContext() *corev1.PodSecurityContext {
// change ownership of the mounted volume to the first non-root user uid=1000
if IsOpenShift() {
return nil
}
runAsUser := int64(1001)
runAsGroup := int64(1002)
return &corev1.PodSecurityContext{
RunAsUser: &runAsUser,
RunAsGroup: &runAsGroup,
FSGroup: &runAsGroup,
}
}if we have defined podSecurityContext then why is it not reflecting in service.yaml. like for containerSecurityContext we do get the set fields like as passed using this function - func defaultSecurityContext(client *kubernetes.Clientset) *corev1.SecurityContext {
runAsNonRoot := true
sc := &corev1.SecurityContext{
Privileged: new(bool),
AllowPrivilegeEscalation: new(bool),
RunAsNonRoot: &runAsNonRoot,
Capabilities: &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
SeccompProfile: nil,
}
if info, err := client.ServerVersion(); err == nil {
var v *semver.Version
v, err = semver.NewVersion(info.String())
if err == nil && v.Compare(oneTwentyFour) >= 0 {
sc.SeccompProfile = &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}
}
}
return sc
} |
|
still if we want to set the podSecurityContext explicitly will have to define new schema in func.yaml followed by creating new struct, setting the value of FSgroup using some function and passing it here - func/pkg/k8s/persistent_volumes.go Line 121 in d2fb76c am I on right track? If yes it would be nice if you could assign this issue to me. |
|
lets just say if I define the property |
It would be nice to be able to set the pod security context in
func.yaml. I ran into this when I was trying to mount a pvc, and I could not write to the pvc. After a lot of digging, I fould that I needed to setfsGrouplike this:This is because the default group is
1000(I used golang'sos/userto find it). I would prefer to be able to set that fromfunc.yaml, or have that set automatically to some sane default.current func.yaml
Here's the currently generated service:
You can see that no
securityContextdata is in the podspec.The text was updated successfully, but these errors were encountered: