tumblr / k8s-sidecar-injector

Kubernetes sidecar injection service
Apache License 2.0
345 stars 75 forks source link

openshift copy runAsUser form main container #55

Open mark-00 opened 3 years ago

mark-00 commented 3 years ago

What's going on?

On openshift standard behavior is to run each pod with a certain uid. This uid is dependant of the namespace the pod is running in. Pods are automaticaly injected with the right Security context and runAsUser settings. This is done before the mutating webhook is called to inject the sidecar. The sidecar can not be configured with the right uid because this is namespace dependent and will not run if the setting is not correct.

Example of the security context info

      securityContext:
        capabilities:
          drop:
            - KILL
            - MKNOD
            - SETGID
            - SETUID
        runAsUser: 1001550000

I have writen some code to add the runAsUser of container 0 to the injected containers.
Is it possible to open a pull request to integrate this feature