github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

kubeadm: prevent PSP blocking of upgrade image prepull

Browse Source 
If the cluster has a PSP that blocks Pods from running as root
the DS that handles upgrade prepull will fail to create its Pods.

Workaround that by adding a PodSecurityContext with RunAsUser=999.
This commit is contained in:
Lubomir I. Ivanov 2019-05-13 00:31:54 +03:00
parent d48f123a40
commit 668d69799a
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/kubeadm/app/phases/upgrade/BUILD
View File

@ -45,6 +45,7 @@ go_library(
"//staging/src/k8s.io/client-go/kubernetes:go_default_library", "//staging/src/k8s.io/client-go/kubernetes:go_default_library",
"//staging/src/k8s.io/client-go/pkg/version:go_default_library", "//staging/src/k8s.io/client-go/pkg/version:go_default_library",
"//vendor/github.com/pkg/errors:go_default_library", "//vendor/github.com/pkg/errors:go_default_library",
"//vendor/k8s.io/utils/pointer:go_default_library",
], ],
) )

8
cmd/kubeadm/app/phases/upgrade/prepull.go
View File

@ -22,13 +22,14 @@ import (
"github.com/pkg/errors" "github.com/pkg/errors"
apps "k8s.io/api/apps/v1" apps "k8s.io/api/apps/v1"
"k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
clientset "k8s.io/client-go/kubernetes" clientset "k8s.io/client-go/kubernetes"
kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm" kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
"k8s.io/kubernetes/cmd/kubeadm/app/constants" "k8s.io/kubernetes/cmd/kubeadm/app/constants"
"k8s.io/kubernetes/cmd/kubeadm/app/images" "k8s.io/kubernetes/cmd/kubeadm/app/images"
"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient" "k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
utilpointer "k8s.io/utils/pointer"
) )
const ( const (
@ -183,6 +184,11 @@ func buildPrePullDaemonSet(component, image string) *apps.DaemonSet {
}, },
Tolerations: []v1.Toleration{constants.ControlPlaneToleration}, Tolerations: []v1.Toleration{constants.ControlPlaneToleration},
TerminationGracePeriodSeconds: &gracePeriodSecs, TerminationGracePeriodSeconds: &gracePeriodSecs,
// Explicitly add a PodSecurityContext to allow these Pods to run as non-root.
// This prevents restrictive PSPs from blocking the Pod creation.
SecurityContext: &v1.PodSecurityContext{
RunAsUser: utilpointer.Int64Ptr(999),
},
}, },
}, },
}, },