deep-stack/kompose
7
0
Fork 0
forked from LaconicNetwork/kompose
Code Pull Requests Activity

feature: support UID:GID in the user key

Browse Source
This commit is contained in:
favonia 2024-08-28 08:00:11 -05:00
parent 51d61400e0
commit 0ace11079e
No known key found for this signature in database
GPG Key ID: 06210CB7076F1EEC
3 changed files with 53 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/transformer/kubernetes/k8sutils.go
View File

@ -641,12 +641,31 @@ func (k *Kubernetes) UpdateKubernetesObjects(name string, service kobject.Servic
securityContext.Privileged = &service.Privileged
}
if service.User != "" {
uid, err := strconv.ParseInt(service.User, 10, 64)
switch userparts := strings.Split(service.User, ":"); len(userparts) {
default:
log.Warn("Ignoring ill-formed user directive. Must be in format UID or UID:GID.")
case 1:
uid, err := strconv.ParseInt(userparts[0], 10, 64)
if err != nil {
log.Warn("Ignoring user directive. User to be specified as a UID (numeric).")
} else {
securityContext.RunAsUser = &uid
}
case 2:
uid, err := strconv.ParseInt(userparts[0], 10, 64)
if err != nil {
log.Warn("Ignoring user name in user directive. User to be specified as a UID (numeric).")
} else {
securityContext.RunAsUser = &uid
}
gid, err := strconv.ParseInt(userparts[1], 10, 64)
if err != nil {
log.Warn("Ignoring group name in user directive. Group to be specified as a GID (numeric).")
} else {
securityContext.RunAsGroup = &gid
}
}
}
//set capabilities if it is not empty

8
pkg/transformer/kubernetes/k8sutils_test.go
View File

@ -22,7 +22,6 @@ import (
"path/filepath"
"reflect"
"sort"
"strconv"
"testing"
"github.com/kubernetes/kompose/pkg/kobject"
@ -208,7 +207,7 @@ func TestCreateServiceWithServiceUser(t *testing.T) {
Expose: []string{"expose"}, // not supported
Privileged: true,
Restart: "always",
User: "1234",
User: "1234:5678",
}
komposeObject := kobject.KomposeObject{
@ -224,8 +223,9 @@ func TestCreateServiceWithServiceUser(t *testing.T) {
for _, obj := range objects {
if deploy, ok := obj.(*appsv1.Deployment); ok {
uid := *deploy.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser
if strconv.FormatInt(uid, 10) != service.User {
t.Errorf("User in ServiceConfig is not matching user in PodSpec")
gid := *deploy.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup
if fmt.Sprintf("%d:%d", uid, gid) != service.User {
t.Errorf("User and group in ServiceConfig is not matching user in PodSpec")
}
}
}

22
pkg/transformer/kubernetes/podspec.go
View File

@ -3,6 +3,7 @@ package kubernetes
import (
"reflect"
"strconv"
"strings"
mapset "github.com/deckarep/golang-set"
"github.com/kubernetes/kompose/pkg/kobject"
@ -143,12 +144,31 @@ func SecurityContext(name string, service kobject.ServiceConfig) PodSpecOption {
securityContext.Privileged = &service.Privileged
}
if service.User != "" {
uid, err := strconv.ParseInt(service.User, 10, 64)
switch userparts := strings.Split(service.User, ":"); len(userparts) {
default:
log.Warn("Ignoring ill-formed user directive. Must be in format UID or UID:GID.")
case 1:
uid, err := strconv.ParseInt(userparts[0], 10, 64)
if err != nil {
log.Warn("Ignoring user directive. User to be specified as a UID (numeric).")
} else {
securityContext.RunAsUser = &uid
}
case 2:
uid, err := strconv.ParseInt(userparts[0], 10, 64)
if err != nil {
log.Warn("Ignoring user name in user directive. User to be specified as a UID (numeric).")
} else {
securityContext.RunAsUser = &uid
}
gid, err := strconv.ParseInt(userparts[1], 10, 64)
if err != nil {
log.Warn("Ignoring group name in user directive. Group to be specified as a GID (numeric).")
} else {
securityContext.RunAsGroup = &gid
}
}
}
// Configure capabilities