How to specify securityContext

Question

How to specify securityContext

kodeninja opened this issue 3 years ago · comments

The k8s cluster I deploy to has a pod security policy, and requires that the Argo workflows have the following, top-level securityContext:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: main-
spec:
  securityContext:
     fsGroup: 2000
     runAsNonRoot: true
     runAsUser: 1000
...

How can I specify that via couler? I couldn't find anything in the docs.

Mingjie Tang · Answer 1 · Fri Apr 30 2021 10:43:33 GMT+0800 (China Standard Time)

actually, we do not support security context at the right moment, please send a PR if you are interested.

…

On Fri, Apr 30, 2021 at 10:31 AM kodeninja ***@***.***> wrote: The k8s cluster I deploy to has a pod security policy, and requires that the Argo workflows have the following, top-level securityContext: apiVersion: argoproj.io/v1alpha1kind: Workflowmetadata: generateName: main-spec: securityContext: fsGroup: 2000 runAsNonRoot: true runAsUser: 1000 ... How can I specify that via couler? I couldn't find anything in the docs. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#200>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAK5R6PGD6WUXGZVZXVHCM3TLIJBVANCNFSM433EVPGA> .

kodeninja · Answer 2 · Fri Apr 30 2021 11:48:17 GMT+0800 (China Standard Time)

@merlintang, I imagine this change would go in https://github.com/couler-proj/couler/blob/master/couler/core/templates/workflow.py?

Mingjie Tang · Answer 3 · Fri Apr 30 2021 11:55:24 GMT+0800 (China Standard Time)

yes, if this security config go to the workflow level, you can change the workflow.py.

…

On Fri, Apr 30, 2021 at 11:48 AM kodeninja ***@***.***> wrote: @merlintang <https://github.com/merlintang>, I imagine this change would go in https://github.com/couler-proj/couler/blob/master/couler/core/templates/workflow.py ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#200 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAK5R6NPC7QCJ5RO4BBOQKTTLISBDANCNFSM433EVPGA> .

kodeninja · Answer 4 · Fri Apr 30 2021 11:57:46 GMT+0800 (China Standard Time)

Right, this applies at the workflow level.

Is this a good PR for reference: #195?

Mingjie Tang · Answer 5 · Fri Apr 30 2021 12:01:44 GMT+0800 (China Standard Time)

yes it is.

…

On Fri, Apr 30, 2021 at 11:58 AM kodeninja ***@***.***> wrote: Right, this applies at the workflow level. Is this a good PR for reference: #195 <#195>? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#200 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAK5R6PL25F4E23D77MNQUTTLITETANCNFSM433EVPGA> .