knative
/
client
mirror of https://github.com/knative/client.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Populate container.SecurityContext.RunAsUser when --user flag is used (#1927) 

* Populate container.SecurityContext.RunAsUser when --user flag is used

* unit test change to use security-context and user flags together
This commit is contained in:
Gunjan Vyas 2024-04-17 15:13:52 +05:30 committed by GitHub
parent 7ebac24b8d
commit 80f5a9a468
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/kn/flags/podspec.go
View File

@ -372,13 +372,6 @@ func (p *PodSpecFlags) ResolvePodSpec(podSpec *corev1.PodSpec, flags *pflag.Flag
UpdateImagePullSecrets(podSpec, p.ImagePullSecrets) UpdateImagePullSecrets(podSpec, p.ImagePullSecrets)
} }
if flags.Changed("user") {
err = UpdateUser(podSpec, p.User)
if err != nil {
return err
}
}
if flags.Changed("containers") || flags.Changed("extra-containers") || p.ExtraContainers == "-" { if flags.Changed("containers") || flags.Changed("extra-containers") || p.ExtraContainers == "-" {
var fromFile *corev1.PodSpec var fromFile *corev1.PodSpec
fromFile, err = decodeContainersFromFile(p.ExtraContainers) fromFile, err = decodeContainersFromFile(p.ExtraContainers)
@ -418,5 +411,12 @@ func (p *PodSpecFlags) ResolvePodSpec(podSpec *corev1.PodSpec, flags *pflag.Flag
} }
} }
if flags.Changed("user") {
err = UpdateUser(podSpec, p.User)
if err != nil {
return err
}
}
return nil return nil
} }

5
pkg/kn/flags/podspec_helper.go
View File

@ -236,9 +236,10 @@ func UpdateContainerPort(spec *corev1.PodSpec, port string) error {
// UpdateUser updates container with a given user id // UpdateUser updates container with a given user id
func UpdateUser(spec *corev1.PodSpec, user int64) error { func UpdateUser(spec *corev1.PodSpec, user int64) error {
container := containerOfPodSpec(spec) container := containerOfPodSpec(spec)
container.SecurityContext = &corev1.SecurityContext{ if container.SecurityContext == nil {
RunAsUser: &user, container.SecurityContext = &v1.SecurityContext{}
} }
container.SecurityContext.RunAsUser = &user
return nil return nil
} }

2
pkg/kn/flags/podspec_test.go
View File

@ -71,7 +71,7 @@ func TestPodSpecResolve(t *testing.T) {
"--port", "8080", "--limit", "cpu=1000m", "--limit", "memory=1024Mi", "--port", "8080", "--limit", "cpu=1000m", "--limit", "memory=1024Mi",
"--cmd", "/app/start", "--arg", "myArg1", "--service-account", "foo-bar-account", "--cmd", "/app/start", "--arg", "myArg1", "--service-account", "foo-bar-account",
"--mount", "/mount/path=volume-name", "--volume", "volume-name=cm:config-map-name", "--mount", "/mount/path=volume-name", "--volume", "volume-name=cm:config-map-name",
"--env-from", "config-map:config-map-name", "--user", "1001", "--pull-policy", "always", "--env-from", "config-map:config-map-name", "--user", "1001", "--security-context", "none", "--pull-policy", "always",
"--probe-readiness", "http::8080:/path", "--probe-liveness", "http::8080:/path"} "--probe-readiness", "http::8080:/path", "--probe-liveness", "http::8080:/path"}
expectedPodSpec := corev1.PodSpec{ expectedPodSpec := corev1.PodSpec{
Containers: []corev1.Container{ Containers: []corev1.Container{