Change:
We need test cases that cover running as Windows users in containers. Windows uses a different field WindowsContainerSecurityContext.runasusername () They should only run with the ginkgo focus set. This will replace the similar test cases on Linux: /kind test /sig windows
/good-first-issue
/assign
GitHub didn't allow me to assign the following users: michellemcone. Note that only and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign I can't assign this to Michelle yet, so I'll park it on myself for now. If it's not done in a few weeks and someone else wants to take it, drop a comment here.
/milestone v1.14
/remove good-first-issue It looks like this may not be ready for testing. has the first half of the feature implemented, but it's still incomplete.
/assign So, when the API for `? Although this come at a later date, since it would need to be implemented in kubelet first.
GitHub didn't allow me to assign the following users: bclau. Note that only and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign </details
/good-first-issue remove
/clear milestone
/milestone clear /kind cleanup
/remove-good-first-issue
/milestone v1.16
Hello! I'm part of the bug triage team for the 1.16 release cycle and considering this issue is tagged for 1.16, but not updated for a long time, I'd like to check its status. The code freeze is starting on August 29th (about 1.5 weeks from now), which means that there should be a PR ready (and merged) until then. Do we still target this issue to be fixed for 1.16? If not please re-tag the issue to the planned milestone.
This issue is addressed by: This should be included in 1.16.

Discussion:
"hybrid_network.go", "memory_limits.go", "networking.go", <ins> "security_context.go", </ins> "service.go", "volumes.go", ],

"//test/e2e/framework/node:go_default_library", "//test/e2e/framework/pod:go_default_library", "//test/e2e/framework/service:go_default_library", <ins> "//test/utils:go_default_library", </ins> "//test/utils/image:go_default_library", "//vendor/github.com/onsi/ginkgo:go_default_library", "//vendor/github.com/onsi/gomega:go_default_library",

<ins> /* Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package windows import ( v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/uuid" "k8s.io/kubernetes/test/e2e/framework" e2elog "k8s.io/kubernetes/test/e2e/framework/log" testutils "k8s.io/kubernetes/test/utils" imageutils "k8s.io/kubernetes/test/utils/image" "github.com/onsi/ginkgo" ) const runAsUserNameContainerName = "run-as-username-container" var _ = SIGDescribe("[Feature:Windows] SecurityContext RunAsUserName", func() { f := framework.NewDefaultFramework("windows-run-as-username") ginkgo.It("should be able create pods and run containers with a given username", func() { ginkgo.By("Creating 2 pods: 1 with the default user, and one with a custom one.") podDefault := runAsUserNamePod(nil) f.TestContainerOutput("check default user", podDefault, 0, []string{"ContainerUser"}) podUserName := runAsUserNamePod(toPtr("ContainerAdministrator")) f.TestContainerOutput("check set user", podUserName, 0, []string{"ContainerAdministrator"}) }) ginkgo.It("should not be able to create pods with unknown usernames", func() { ginkgo.By("Creating a pod with an invalid username") podInvalid := f.PodClient().Create(runAsUserNamePod(toPtr("FooLish"))) e2elog.Logf("Waiting for pod %s to enter the error state.", podInvalid.Name) framework.ExpectNoError(f.WaitForPodTerminated(podInvalid.Name, "")) podInvalid, _ = f.PodClient().Get(podInvalid.Name, metav1.GetOptions{}) podTerminatedReason := testutils.TerminatedContainers(podInvalid)[runAsUserNameContainerName] if "ContainerCannotRun" != podTerminatedReason { e2elog.Failf("The container terminated reason was supposed to be: 'ContainerCannotRun', not: '%q'", podTerminatedReason) } }) ginkgo.It("should override SecurityContext username if set", func() { ginkgo.By("Creating a pod with 2 containers with different username configurations.") pod := runAsUserNamePod(toPtr("ContainerAdministrator")) pod.Spec.Containers[0].SecurityContext.WindowsOptions.RunAsUserName = toPtr("ContainerUser") pod.Spec.Containers = append(pod.Spec.Containers, v1.Container{ Name:    "run-as-username-new-container", Image:   imageutils.GetE2EImage(imageutils.NonRoot), Command: []string{"cmd", "/S", "/C", "echo %username%"}, }) f.TestContainerOutput("check overridden username", pod, 0, []string{"ContainerUser"}) f.TestContainerOutput("check pod SecurityContext username", pod, 1, []string{"ContainerAdministrator"}) }) }) func runAsUserNamePod(username *string) *v1.Pod { podName := "run-as-username-" + string(uuid.NewUUID()) return &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: podName, }, Spec: v1.PodSpec{ Containers: []v1.Container{ { Name:    runAsUserNameContainerName, Image:   imageutils.GetE2EImage(imageutils.NonRoot), Command: []string{"cmd", "/S", "/C", "echo %username%"}, SecurityContext: &v1.SecurityContext{ WindowsOptions: &v1.WindowsSecurityContextOptions{ RunAsUserName: username, }, }, }, }, SecurityContext: &v1.PodSecurityContext{ WindowsOptions: &v1.WindowsSecurityContextOptions{ RunAsUserName: username, }, }, RestartPolicy: v1.RestartPolicyNever, }, } } func toPtr(s string) *string { return &s } </ins>