Change:
projected volumes exclude ephemeral containers in calculating fs user because "SecurityContext is not allowed" : This is no longer technically correct -- ephemeral containers are allowed to specify security context -- but it's a no-op because is guaranteed to be empty at pod creation when fs user is calculated. Still, the comment is wrong so let's clean it up to avoid confusion. /kind cleanup
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig storage /assign
/priority backlog
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue as fresh with Close this issue with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle rotten [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Reopen this issue with Mark this issue as fresh with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /close not-planned [1]:
Closing this issue, marking it as "Not Planned". <detailsIn response to : The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closedReopen this issue with Mark this issue as fresh with Offer to help out with [Issue Triage][1] Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/remove-lifecycle rotten

Discussion:
// attributes. func FsUserFrom(pod *v1.Pod) *int64 { var fsUser *int64 <del> // Exclude ephemeral containers because SecurityContext is not allowed. podutil.VisitContainers(&pod.Spec, podutil.InitContainers|podutil.Containers, func(container *v1.Container, containerType podutil.ContainerType) bool { </del> <ins> podutil.VisitContainers(&pod.Spec, podutil.AllFeatureEnabledContainers(), func(container *v1.Container, containerType podutil.ContainerType) bool { </ins> runAsUser, ok := securitycontext.DetermineEffectiveRunAsUser(pod, container) // One container doesn't specify user or there are more than one // non-root UIDs.

"k8s.io/kubernetes/pkg/features" "k8s.io/kubernetes/pkg/util/slice" "k8s.io/kubernetes/pkg/volume" <del> utilptr "k8s.io/utils/pointer" </del> <ins> "k8s.io/utils/ptr" </ins> ) func TestLoadPodFromFile(t *testing.T) {

InitContainers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), </ins> }, }, }, Containers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), </ins> }, }, {

InitContainers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(999), </del> <ins> RunAsUser: ptr.To[int64](999), </ins> }, }, }, Containers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), </ins> }, }, { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), }, }, }, EphemeralContainers: []v1.EphemeralContainer{ { EphemeralContainerCommon: v1.EphemeralContainerCommon{ SecurityContext: &v1.SecurityContext{ RunAsUser: ptr.To[int64](1001), }, </ins> }, }, },

wantFsUser: nil, }, { <ins> desc: "init and regular containers have runAsUser specified and the same", pod: &v1.Pod{ Spec: v1.PodSpec{ SecurityContext: &v1.PodSecurityContext{}, InitContainers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ RunAsUser: ptr.To[int64](1000), }, }, }, Containers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ RunAsUser: ptr.To[int64](1000), }, }, { SecurityContext: &v1.SecurityContext{ RunAsUser: ptr.To[int64](1000), }, }, }, }, }, wantFsUser: ptr.To[int64](1000), }, { </ins> desc: "all have runAsUser specified and the same", pod: &v1.Pod{ Spec: v1.PodSpec{

InitContainers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), </ins> }, }, }, Containers: []v1.Container{ { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), </ins> }, }, { SecurityContext: &v1.SecurityContext{ <del> RunAsUser: utilptr.Int64Ptr(1000), </del> <ins> RunAsUser: ptr.To[int64](1000), }, }, }, EphemeralContainers: []v1.EphemeralContainer{ { EphemeralContainerCommon: v1.EphemeralContainerCommon{ SecurityContext: &v1.SecurityContext{ RunAsUser: ptr.To[int64](1000), }, </ins> }, }, }, }, }, <del> wantFsUser: utilptr.Int64Ptr(1000), </del> <ins> wantFsUser: ptr.To[int64](1000), </ins> }, }