我有兩個集群。Kubernetes 1.25 和 Openshift 4.11
apiVersion: apps/v1
kind: Deployment
metadata:
name: testcustom
#namespace: ics-e2e-pods-456
namespace: ics-e2e-deploy-7887
labels:
app: testcustom
spec:
replicas: 1
selector:
matchLabels:
app: testcustom
template:
metadata:
labels:
app: testcustom
spec:
containers:
- image: busybox #image name which should be avilable within cluster
name: container-name # name of the container inside POD
volumeMounts:
- mountPath: /myvolumepath # mount path for pvc from container
name: pvc-name # pvc name for this pod
securityContext:
fsGroup: 1000
seccompProfile:
type: RuntimeDefault
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
capabilities:
drop: ["ALL"]
volumes:
- name: pvc-name # volume resource name in this POD, user can choose any name as per kubernetes
persistentVolumeClaim:
claimName: csi-block-pvc-custom-one # pvc name which was created by using claim.yaml file
當我嘗試部署此 pod 時，它在上述任何一個集群中都失敗，拋出與安全背景關系相關的錯誤。如果我為一個集群解決問題，相同的規范在其他集群中不起作用。我想知道如何獲得可以在兩個集群中使用的通用部署檔案
錯誤
Error creating: pods "testcustom-589767ccd5-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, spec.containers[0].securityContext.runAsUser: Invalid value: 1000: must be in the ranges: [1000640000, 1000649999], provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": : Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]
uj5u.com熱心網友回復：
在創建命名空間/專案時的 openshift 中，請確保正確指定以下范圍。這些值應映射到 fsgroup 和 runAsUser 的 yaml 定義中指定的安全背景關系。更多細節在openshift檔案中。相同的 pod 定義將在 k8s 和 openshift 中作業。
openshift.io/sa.scc.uid-range
openshift.io/sa.scc.supplemental-groups
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/517192.html