Okay, let's go through this lab on security context.
What does the user use to execute the sleep process
within the ubuntu-sleeper pod?
That's the question. Let's take a look at it.
We have a pod called ubuntu-sleeper
and to exec into it, we could use kubectl exec pod ubuntu-sleeper.
Sorry, just exec without pod,
and then here we provide the command.
To know what user you're logged in as, you could just do 'whoami'
and this is basically we're getting into the container, or into the pod,
and running the 'whoami' command and it tells us that it's root.
That is a user, the default user, with which commands are run.
Now, edit the pod to run the sleep process with user ID 1010.
We're going to edit the pod ubuntu-sleeper
and we want this to run with the user ID 1010.
We're going to add security context to it.
Security context,
and we're going to specify--
If you're not sure about security context,
let's search for security context,
and under security context, you have 'run as user',
'run as group', or FS group.
Let's get this
and the user ID is 1010.
Save that.
We're editing a pod, so we can't save it.
We can do a kubectl replace, force
and the file.
Let's check our work.
Okay, so that's successful.
Okay, now when I run the exit command
and run the 'Who am I', I get this back.
I see that 'who am I' cannot find name for the user ID.
Basically, we're running the process with the user ID 1010,
but there's no user name configured for it.
That's why this is returning,
but at least we know that the pod is now running the container
with the user ID 1010.
That worked.
Okay, the next question is to view the multi-pod.yaml
and with what user are the processes in the web container started.
There are two containers.
You have the web container here,
and then you have the sidecar container,
and then also note that there are two security contexts.
There's a security context specification here,
and there's one here.
There's one at the pod level,
and then there's one at the container level.
As we've learned, the container level security context
is going to override whatever is specified here.
The question is,
with what user are the processes in the web container started.
This is the web container, and the user is this particular user.
That's this.
Now with what user are the processes in the sidecar container started?
The sidecar container does not have a security context specified,
so it's always going to use this.
Now update the pod ubuntu-sleeper to run as root user
and with SYS_TIME capability.
We're going to update the pod ubuntu-sleeper
and here we have the security context section
and we're going to add capabilities
and we know that this is an array,
so we're going to take a look,
set capabilities for a container,
and capabilities are 'add'
to give add, and then specify
the list of capabilities that we're going to add.
That's add,
so it's not an array.
Just add
and we have SYS_TIME in it.
Let's save that.
It's not going to allow us to save that.
We're going to do a replace, force,
then the file name.
Let's wait for it to be recreated.
That's done.
Let's check the work.
That's successful.
Now it says update the pod
to also make use of the NET_ADMIN capability.
Let's do that again.
Let's add NET_ADMIN.
Here you see the format is now changed to the array format.
Either of the format is fine.
Now you've added NET_ADMIN and save.
Working.
You're going to do a replace, force
and specify the file.
That's done.
Lets check the work.
All right, that's the end of this lab.