Comments (1)
I believe there are more ways to deal with it. Either we will set the security policy on Pod like:
SeccompProfile secCom = new SeccompProfile();
secCom.setType("RuntimeDefault");
Capabilities cap = new Capabilities();
cap.setDrop(Arrays.asList("ALL"));
SecurityContext secContext = container.getSecurityContext();
container.setCommand(Arrays.asList("/bin/bash", "-c", "sleep infinity"));
SecurityContext updateSecContext = new SecurityContext();
updateSecContext.setAllowPrivilegeEscalation(false);
updateSecContext.setRunAsNonRoot(true);
updateSecContext.setSeccompProfile(secCom);
updateSecContext.setCapabilities(cap);
// Apply the security context to the container object.
container.setSecurityContext(updateSecContext);
PodSpec podSpec = new PodSpec();
podSpec.setContainers(Collections.singletonList(container));
Pod pod = new Pod();
pod.setMetadata(new ObjectMetaBuilder().withName(name).build());
pod.setSpec(podSpec);
openShift.createPod(pod);
or change labels on namespace:
pod-security.kubernetes.io/enforce=restricted
-> pod-security.kubernetes.io/enforce=privileged
and then change it back once pod is created.
from xtf.
Related Issues (20)
- Add configuration for connection waiting time HOT 5
- Optional configuration for downloading ocp binary client from working cluster HOT 1
- Extend tests and description of EventList* classes to include multiline messages matching
- If parameterized tests fail then OpenShiftRecorderService throws java.nio.file.FileAlreadyExistsException when overriding files from build namespace
- Drop OCP 3 support as it is "End of Maintenance Support"
- Introduce tech preview/experimental features HOT 2
- support mountTrustedCA attribute for BuildConfigs
- Add support for `HELM_KUBEINSECURE_SKIP_TLS_VERIFY` in Helm Client HOT 1
- Inclusive language
- Ideas - Refactor XTF to better handle running tests in separate namespaces
- Non-GA OCP versions not being matched HOT 1
- No fallback when OCP version does not match
- StartupProbes support
- XTF does not support custom Kubeconfig with cert/key file for OpenShiftBinary HOT 15
- XTF code formating
- Is BuildManager wrongly creating a system:image-puller RoleBinding?
- Error reading service account token from: [/var/run/secrets/kubernetes.io/serviceaccount/token]
- Impsort plugin fails with Maven 3.9.1
- configMapKeyRef and secretKeyRef: name and key are inverted HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from xtf.