Kubernetes中的Pod啟動命令

Question

我想將docker命令--user $(id -u):$(id -g)到我的k8s部署定義中。 k8s中的等效值是多少？

參數或命令？

容器如何正常啟動：

docker run -d -p 5901:5901 -p 6901:6901 --user $(id -u):$(id -g) khwhahn/daedalus:0.1

k8s deployment
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose --file docker-compose.yaml convert
    kompose.version: 1.10.0 (8bb0907)
  creationTimestamp: null
  labels:
    io.kompose.service: daedalus
  name: daedalus
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        io.kompose.service: daedalus
    spec:
      containers:
      - env:
        - name: DISPLAY
        image: khwhahn/daedalus:0.1
        imagePullPolicy: Always
        ports:
          - containerPort: 5901
            name: vnc
            protocol: TCP
          - containerPort: 6901
            name: http
            protocol: TCP
        livenessProbe:
            httpGet:
              path: /
              port: 6901
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /
            port: 6901
            scheme: HTTP
          initialDelaySeconds: 10
          timeoutSeconds: 1
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        name: daedalus
        resources: {}
        volumeMounts:
        - mountPath: /tmp/.X11-unix
          name: daedalus-claim0
        - mountPath: /home/daedalus/daedalus/tls
          name: cardano-tls
      restartPolicy: Always
      volumes:
      - name: daedalus-claim0
        persistentVolumeClaim:
          claimName: daedalus-claim0
      - name: cardano-tls
        persistentVolumeClaim:
          claimName: cardano-tls
status: {}

謝謝

Answer 1

最初在kubernetes問題22179中對此進行了請求。

部分實現於：

• PR 52077：“ RunAsGroup的API更改” ，
• PR 756：“允許指定容器的主要組ID”

PodSecurityContext允許Kubernetes用戶指定RunAsUser，RunAsUser可以在每個容器中在SecurityContext中覆蓋RunAsUser。

在SecurityContext和PodSecurityContext中引入一個名為RunAsGroup的新API字段。

請參閱“ 為Pod或容器配置安全上下文 ”。