WEBVTT

00:01.560 --> 00:05.220
Okay, let's go through this lab
on security context.

00:05.753 --> 00:09.126
What does the user use
to execute the sleep process

00:09.206 --> 00:11.520
within the ubuntu-sleeper pod?

00:11.980 --> 00:14.346
That's the question.
Let's take a look at it.

00:14.426 --> 00:18.386
We have a pod called ubuntu-sleeper

00:18.820 --> 00:25.813
and to exec into it, we could use
kubectl exec pod ubuntu-sleeper.

00:29.353 --> 00:31.766
Sorry, just exec without pod,

00:32.553 --> 00:35.580
and then here we provide the command.

00:36.013 --> 00:39.786
To know what user you're logged in as,
you could just do 'whoami'

00:40.486 --> 00:45.133
and this is basically we're getting
into the container, or into the pod,

00:45.740 --> 00:50.206
and running the 'whoami' command
and it tells us that it's root.

00:51.020 --> 00:54.866
That is a user, the default user,
with which commands are run.

00:56.620 --> 01:03.320
Now, edit the pod to run
the sleep process with user ID 1010.

01:03.426 --> 01:07.960
We're going to edit the pod
ubuntu-sleeper

01:09.740 --> 01:16.273
and we want this to run
with the user ID 1010.

01:16.353 --> 01:18.960
We're going to add
security context to it.

01:20.000 --> 01:24.126
Security context,

01:24.666 --> 01:26.806
and we're going to specify--

01:29.713 --> 01:31.820
If you're not sure
about security context,

01:31.900 --> 01:34.666
let's search for security context,

01:38.246 --> 01:41.073
and under security context,
you have 'run as user',

01:41.173 --> 01:42.720
'run as group', or FS group.

01:42.800 --> 01:44.413
Let's get this

01:47.080 --> 01:49.160
and the user ID is 1010.

01:51.266 --> 01:52.266
Save that.

01:54.586 --> 01:56.570
We're editing a pod,
so we can't save it.

01:56.650 --> 02:00.613
We can do a kubectl replace, force

02:04.133 --> 02:05.133
and the file.

02:07.980 --> 02:09.100
Let's check our work.

02:10.820 --> 02:13.466
Okay, so that's successful.

02:20.633 --> 02:23.300
Okay, now when I run the exit command

02:23.380 --> 02:26.480
and run the 'Who am I',
I get this back.

02:26.560 --> 02:30.113
I see that 'who am I'
cannot find name for the user ID.

02:30.380 --> 02:34.020
Basically, we're running the process
with the user ID 1010,

02:34.100 --> 02:36.373
but there's no user name
configured for it.

02:36.453 --> 02:38.246
That's why this is returning,

02:38.326 --> 02:43.046
but at least we know that the pod
is now running the container

02:43.340 --> 02:45.420
with the user ID 1010.

02:45.500 --> 02:46.613
That worked.

02:48.973 --> 02:54.513
Okay, the next question is to view
the multi-pod.yaml

02:55.240 --> 02:59.626
and with what user are the processes
in the web container started.

02:59.706 --> 03:00.993
There are two containers.

03:01.073 --> 03:02.386
You have the web container here,

03:02.466 --> 03:04.000
and then you have
the sidecar container,

03:04.706 --> 03:07.280
and then also note that
there are two security contexts.

03:07.360 --> 03:09.213
There's a security context
specification here,

03:09.293 --> 03:10.293
and there's one here.

03:10.653 --> 03:12.000
There's one at the pod level,

03:12.080 --> 03:13.720
and then there's one
at the container level.

03:14.140 --> 03:17.560
As we've learned,
the container level security context

03:17.640 --> 03:19.946
is going to override
whatever is specified here.

03:20.353 --> 03:21.626
The question is,

03:21.793 --> 03:24.960
with what user are the processes
in the web container started.

03:25.040 --> 03:30.646
This is the web container,
and the user is this particular user.

03:30.726 --> 03:32.353
That's this.

03:35.100 --> 03:37.853
Now with what user are the processes
in the sidecar container started?

03:37.933 --> 03:41.493
The sidecar container does not have
a security context specified,

03:41.573 --> 03:43.573
so it's always going to use this.

03:48.506 --> 03:52.193
Now update the pod ubuntu-sleeper
to run as root user

03:52.666 --> 03:54.873
and with SYS_TIME capability.

03:55.320 --> 04:00.433
We're going to update
the pod ubuntu-sleeper

04:02.700 --> 04:05.840
and here we have
the security context section

04:06.600 --> 04:09.980
and we're going to add capabilities

04:10.920 --> 04:12.393
and we know that this is an array,

04:12.473 --> 04:16.240
so we're going to take a look,

04:20.100 --> 04:21.786
set capabilities for a container,

04:23.020 --> 04:28.580
and capabilities are 'add'

04:29.613 --> 04:31.880
to give add, and then specify

04:32.353 --> 04:34.493
the list of capabilities
that we're going to add.

04:36.220 --> 04:37.653
That's add,

04:39.853 --> 04:41.013
so it's not an array.

04:45.866 --> 04:46.866
Just add

04:48.313 --> 04:55.233
and we have SYS_TIME in it.

04:58.653 --> 04:59.780
Let's save that.

05:00.766 --> 05:02.733
It's not going to allow us
to save that.

05:02.813 --> 05:06.800
We're going to do a replace, force,

05:11.680 --> 05:12.680
then the file name.

05:13.600 --> 05:16.413
Let's wait for it to be recreated.

05:20.146 --> 05:21.300
That's done.

05:22.700 --> 05:24.160
Let's check the work.

05:24.760 --> 05:26.500
That's successful.

05:29.170 --> 05:31.006
Now it says update the pod

05:31.086 --> 05:34.133
to also make use
of the NET_ADMIN capability.

05:34.980 --> 05:36.133
Let's do that again.

05:37.853 --> 05:39.740
Let's add NET_ADMIN.

05:40.240 --> 05:44.880
Here you see the format
is now changed to the array format.

05:47.493 --> 05:49.160
Either of the format is fine.

05:49.766 --> 05:53.073
Now you've added NET_ADMIN and save.

05:54.440 --> 05:55.553
Working.

05:56.040 --> 05:58.880
You're going to do a replace, force

06:00.326 --> 06:02.860
and specify the file.

06:04.586 --> 06:05.820
That's done.

06:06.060 --> 06:07.060
Lets check the work.

06:08.120 --> 06:11.026
All right, that's the end
of this lab.