[Kubernetes] 50. Security Context(in Kubernetes)

 

Security 설정
Pod 레벨에서 설정 시 내부의 모든 Container에도 동시에 적용됨

Container 레벨에서 설정 시 Pod레벨 설정이 무효화 되고 Container레벨 설정만 적용됨

 

Pod 레벨에서 보안 설정

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext: # 추가
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    supplementalGroups: [4000]
    capabilities:
      add: ["MAC_ADMIN"] # 추가
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox:1.28
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

 

Container 레벨 보안 설정

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    supplementalGroups: [4000]
  containers:
  - name: sec-ctx-demo
    image: registry.k8s.io/e2e-test-images/agnhost:2.45
    command: [ "sh", "-c", "sleep 1h" ]
    securityContext:
      allowPrivilegeEscalation: false

 

 

whoami

kubectl exec [pod name] -- whoami