container の privileged, runAsUser, hostPath 設定



特権(privileged)コンテナの作成、実行ユーザー変更、ホスト・ディレクトリへのマウントを実施する必要があり、設定方法を確認。

---
実行環境：
IBM Cloud Kubernetes Service (IKS) v1.18

---

サンプル・コンテナ① 特権とroot 起動設定


```sample-container1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: sample-container
spec:
  securityContext:                       #<= add
    runAsUser: 0                         #<= add
  containers:
    - name: sample-container
      image: centos:7
      securityContext:                   #<= add
         privileged: true                #<= add 
      command: ["/bin/sleep", "1200000"]
```


- runAsUser 0 で rootで稼働
- "securityContext: privileged: ture "を追加


---
サンプル・コンテナ② 特権とroot 起動設定ホスト・ディレクトリへのマウントを設定

```sample-container2.yaml
apiVersion: v1
kind: Pod   
metadata:
  name: sample-container
spec:
  securityContext:                       #<= add
    runAsUser: 0                         #<= add
  containers:
    - name: sample-container
      image: centos:7
      securityContext:                   #<= add
        privileged: true                 #<= add 
      command: ["/bin/sleep", "1200000"]
      volumeMounts:
      - mountPath: /test 　　　　　　　 #<= コンテナの/test ディレクトリにホストの/etcをマウント
        name: test-hostpath 
  volumes:
  - name: test-hostpath 
    hostPath:                           #<= hostPath 設定
      path: /etc　　　　　　　　　　　　　　 #<= /etc を指定
      type: Directory
```

---
Pod 作成

```
$ kubectl apply -f sample-container.yml
pod/sample-container created
```

ログイン

```
$ kubectl exec -it sample-container -- /bin/sh
sh-4.2# whoami
root
sh-4.2# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"
```
-> centOS 7 で rootで稼働していることを確認

```
sh-4.2# ls /
anaconda-post.log  bin	dev  etc  home	lib  lib64  media  mnt	opt  proc  root  run  sbin  srv  sys  test  tmp  usr  var
sh-4.2# ls /test
NetworkManager		       debconf.conf	    iscsi	     netconfig		      rsyslog.conf
X11			       debian_version	    issue	     netplan		      rsyslog.d
acpi			       default		    issue.net	     network		      screenrc
adduser.conf		       deluser.conf	    kernel	     networkd-dispatcher      securetty
alternatives		       depmod.d		    kernel-img.conf  networks		      security
apm			       dhcp		    kubernetes	     newt		      selinux
apparmor		       dnsmasq.d	    landscape	     nsswitch.conf	      services
apparmor.d		       dnsmasq.d-available  ld.so.cache      ntp.conf		      shadow
apport			       dpkg		    ld.so.conf	     opt		      shadow-
apt			       ec2_version	    ld.so.conf.d     os-release		      shells
armada			       environment	    ldap	     overlayroot.conf	      skel
armadabootstrap		       ethertypes	    legal	     overlayroot.local.conf   sos.conf
at.allow		       fonts		    libaudit.conf    pam.conf		      ssh
bash.bashrc		       fstab		    libibverbs.d     pam.d		      ssl
bash_completion		       fuse.conf	    libnl-3	     passwd		      subgid
bash_completion.d	       gai.conf		    locale.alias     passwd-		      subgid-
bindresvport.blacklist	       groff		    locale.gen	     perl		      subuid
binfmt.d		       group		    localtime	     pm			      subuid-
byobu			       group-		    logcheck	     polkit-1		      sudoers
ca-certificates		       grub.d		    login.defs	     pollinate		      sudoers.d
ca-certificates.conf	       gshadow		    logrotate.conf   popularity-contest.conf  sysctl.conf
ca-certificates.conf.dpkg-old  gshadow-		    logrotate.d      profile		      sysctl.d
calendar		       gss		    lsb-release      profile.d		      systemd
cloud			       haproxy		    ltrace.conf      protocols		      terminfo
cni			       hdparm.conf	    lvm		     python3		      timezone
console-setup		       host.conf	    machine-id	     python3.6		      tmpfiles.d
containerd		       hostname		    magic	     rc0.d		      ucf.conf
cracklib		       hosts		    magic.mime	     rc1.d		      udev
crictl.yaml		       hosts.allow	    mailcap	     rc2.d		      ufw
cron.allow		       hosts.deny	    mailcap.order    rc3.d		      update-manager
cron.d			       hosts_bk		    manpath.config   rc4.d		      update-motd.d
cron.daily		       idmapd.conf	    mdadm	     rc5.d		      update-notifier
cron.hourly		       init		    mime.types	     rc6.d		      updatedb.conf
cron.monthly		       init.d		    mke2fs.conf      rcS.d		      vim
cron.weekly		       initramfs-tools	    modprobe.d	     request-key.conf	      vmware-tools
crontab			       inputrc		    modules	     request-key.d	      vtrgb
cryptsetup-initramfs	       insserv.conf.d	    modules-load.d   resolv.conf	      wgetrc
crypttab		       iproute2		    mtab	     rmt		      xdg
dbus-1			       iptables		    nanorc	     rpc		      zsh_command_not_found
```

-> /test にホストのディレクトリがマウントされていることを確認


----
参考：

・Configure a Security Context for a Pod or Container
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

・Podセキュリティの標準
https://kubernetes.io/ja/docs/concepts/security/pod-security-standards/

・Volumes
https://kubernetes.io/docs/concepts/storage/volumes/