"K8s privileged"의 두 판 사이의 차이

2024년 6월 8일 (토) 22:38 판

1 개요

k8s privileged
쿠버네티스 privileged

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: example
spec:
  privileged: false  # Don't allow privileged pods!
  # The rest fills in some required fields.
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
  - '*'

...
spec:
  template:
    spec:
      initContainers:
      - name: configure-sysctl
        image: busybox
        securityContext:
          runAsUser: 0
          privileged: true
        command: ["sysctl", "-w", "vm.max_map_count=262144"]

...
spec:
  template:
    spec:
      initContainers:
      - name: init-sysctl
        image: busybox:1.27.2
        command:
        - sysctl
        - -w
        - vm.max_map_count=262144
        securityContext:
          privileged: true

2 같이 보기

3 참고

@@ 3번째 줄: / 3번째 줄: @@
 ;쿠버네티스 privileged
-<syntaxhighlight lang='yaml' line>
+<syntaxhighlight lang='yaml' line highlight='6'>
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
@@ 22번째 줄: / 22번째 줄: @@
    - '*'
 </syntaxhighlight>
-<syntaxhighlight lang='yaml' line>
+<syntaxhighlight lang='yaml' line highlight='10'>
 ...
 spec:
@@ 35번째 줄: / 35번째 줄: @@
          command: ["sysctl", "-w", "vm.max_map_count=262144"]
 </syntaxhighlight>
-<syntaxhighlight lang='yaml' line>
+<syntaxhighlight lang='yaml' line highlight='13'>
 ...
 spec: