opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-25 20:26:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Kube Gen run as user/group issues

Browse Source 
Removed the inclusion of RunAsUser or RunAsGroup unless a container is run with the --user flag. When building from an image
the user will be pulled from there anyway

resolves #11914

Signed-off-by: cdoern <cdoern@redhat.com>
This commit is contained in:
cdoern
2021-10-11 11:01:36 -04:00
parent ea868933e8
commit 4631f5b283
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libpod/kube.go
View File

@ -485,6 +485,10 @@ func containerToV1Container(ctx context.Context, c *Container) (v1.Container, []
kubeContainer.Command = nil kubeContainer.Command = nil
} }
if imgData.User == c.User() {
kubeSec.RunAsGroup, kubeSec.RunAsUser = nil, nil
}
kubeContainer.WorkingDir = c.WorkingDir() kubeContainer.WorkingDir = c.WorkingDir()
kubeContainer.Ports = ports kubeContainer.Ports = ports
// This should not be applicable // This should not be applicable

2
test/e2e/generate_kube_test.go
View File

@ -942,7 +942,7 @@ USER test1`
pod := new(v1.Pod) pod := new(v1.Pod)
err = yaml.Unmarshal(kube.Out.Contents(), pod) err = yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).To(BeNil()) Expect(err).To(BeNil())
Expect(*pod.Spec.Containers[0].SecurityContext.RunAsUser).To(Equal(int64(10001))) Expect(pod.Spec.Containers[0].SecurityContext.RunAsUser).To(BeNil())
}) })
It("podman generate kube on named volume", func() { It("podman generate kube on named volume", func() {