k8s支持Capability机制

后端云

发布于 2020-06-11 15:28:47

1.8K0

发布于 2020-06-11 15:28:47

文章被收录于专栏：后端云后端云

比如，我们可以通过给给容器add NET_ADMIN Capability，使得我们可以对network interface进行modify，对应的docker run命令如下：

$ docker run -it --rm --cap-add=NET_ADMIN ubuntu:14.04 ip link add dummy0 type dummy

在Kubernetes对Pod的定义中，用户可以add/drop Capabilities在Pod.spec.containers.sercurityContext.capabilities中添加要add的Capabilities list和drop的Capabilities list。

[root@paasm1 ~]# cat pause.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pause
spec:
  containers:
    - name:  pause
      image: registry.paas/cmss/busybox
      command: [ "sh", "-c", "sleep 1h" ]

[root@paasm1 ~]# kubectl create -f pause.yaml
pod/pause created
[root@paasm1 ~]# kubectl get pod
NAME                                        READY   STATUS             RESTARTS   AGE
docker-paasn1                               0/1     Pending            0          19d
independent-jaguar-nginx-647f7998cd-gstrj   0/1     ImagePullBackOff   0          45h
pause                                       1/1     Running            0          27s
r00tf0rm3                                   0/1     ErrImagePull       0          19d
[root@paasm1 ~]# kubectl exec pause -it sh
/ # vi
/ # date
Fri May 22 06:44:13 UTC 2020
/ # date -s 09:09
date: can't set date: Operation not permitted
Fri May 22 09:09:00 UTC 2020
/ # [root@paasm1 ~]#

Pod pause不能修改系统时间

[root@paasm1 ~]# cat pause1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pause1
spec:
  containers:
    - name:  pause1
      image: registry.paas/cmss/busybox
      command: [ "sh", "-c", "sleep 1h" ]
      securityContext:
        capabilities:
          add: ["NET_ADMIN","SYS_TIME"]

[root@paasm1 ~]# kubectl create -f pause1.yaml
pod/pause1 created
[root@paasm1 ~]# kubectl get pod
NAME                                        READY   STATUS             RESTARTS   AGE
docker-paasn1                               0/1     Pending            0          19d
independent-jaguar-nginx-647f7998cd-gstrj   0/1     ImagePullBackOff   0          45h
pause                                       1/1     Running            0          7m42s
pause1                                      1/1     Running            0          30s
r00tf0rm3                                   0/1     ErrImagePull       0          19d
[root@paasm1 ~]# kubectl exec pause1 -it sh
/ # date
Fri May 22 01:13:12 UTC 2020
/ # date -s 20:20
Fri May 22 20:20:00 UTC 2020
/ # date
Fri May 22 20:20:01 UTC 2020
/ # [root@paasm1 ~]#

Pod pause1可以修改系统时间

本文参与腾讯云自媒体分享计划，分享自微信公众号。

原始发表：2020-06-09，如有侵权请联系 cloudcommunity@tencent.com 删除

kubernetes