Provide RunAsGroup feature for Containers in a Pod

[krmayankk]

Feature Description

As a Kubernetes User, i should be able to specify both user id and group id for the containers running inside a pod on a per Container basis, similar to how docker allows that using docker run options -u, --user="" Username or UID (format: <name|uid>[:<group|gid>]) format. Currently kubernetes only allows us to control the primary user id and allows us to add supplemental groups. There is no way to control the primary group id of the running container which is always 0(root).
This feature would enable enterprises to run containers as non root(non zero uid and non zero gid) and hence improve the level of security for the running containers. More discussion and agreement was gathered in this issue 22179

• One-line feature description (can be used as a release note): Provide RunAsGroup feature for Containers in a Pod
• Primary contact (assignee): @krmayankk
• Responsible SIGs: sig-node, sig-auth
• Design proposal link (community repo): Allow specifying the primary group id of the container community#756
• KEP: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190131-runas-groupid.md
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred: @pmorie @liggitt @tallclair
• Approver (likely from SIG/area to which feature belongs): TBD
• Feature target (which target equals to which milestone):
  Alpha release: v1.10
  Beta release: v1.14
  Stable release target v1.15

List of Work Items:-

• RunAsGroup Implementation
• Add feature flag , mark it alpha and disable by default
• PSP Implementation for RunAsGroup
• Verify e2e and Unit test Coverage
• Verify Containerd and cri-o Test coverage

Containerd and Cri-o Implementation PR's

• container_create: support CRI RunAsGroup cri-o/cri-o#1601
• RunAsGroup fixes and tests cri-o/cri-o#1898
• Add RunAsGroup support. containerd/cri#710

Test Results for CRI-O PR with latest Kubernetes Master
https://k8s-testgrid.appspot.com/sig-node-cri-o#crio-e2e-fedora

Test Coverage for CRI-O and containerd tests running as part of critest

• https://github.com/kubernetes-sigs/cri-tools/blob/16911795a3c33833fa0ec83dac1ade3172f6989e/pkg/validate/security_context_linux.go#L357
• https://github.com/kubernetes-sigs/cri-tools/actions?query=workflow%3A%22critest+containerd%22
• https://github.com/kubernetes-sigs/cri-tools/actions?query=workflow%3A%22critest+CRI-O%22

[ghost]

Is the progress listed above accurate?

[krmayankk]

I started working on this earlier but got distracted by other higher priority issues . We need this feature hence I will prioritize this again . Expect a PRoposal and a first PR in the next couple weeks

On Tue, May 2, 2017 at 8:46 AM Dennis Schridde ***@***.***> wrote: Is the progress listed above accurate? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#213 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AP4-NM7iZmBnKFNe_ywx_6BSd_Aecz_Vks5r10_BgaJpZM4MhoLz> .

-- -Mayank

[pineking]

@krmayankk any progress to update?

[krmayankk]

@pineking i have the proposal , and the code almost ready. Will send out the proposal by Friday while i try to figure the unit tests and api changes.

[jduncan-rva]

@krmayankk is this still on your radar?

[krmayankk]

@jduncan-rva yes the proposal is already out. I have some review comments which i will address. I should have a PR by next week.

[kincl]

@krmayankk any updates?

[krmayankk]

@kincl the proposal is already out and nearing lgtm. We are waiting one more reviewer to review. I was out last week on vacation. I should have the actual PR this week

[krmayankk]

Here is the proposal under review kubernetes/community#756

[php-coder]

Responsible SIGs: sig-node

Sounds like it falls into sig-auth area.

[php-coder]

For the history: here is an implementation of the proposal -- kubernetes/kubernetes#52077

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[php-coder]

/remove-lifecycle rotten

[krmayankk]

/sig auth

[krmayankk]

/sig node

[justaugustus]

@krmayankk
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  • stage/{alpha,beta,stable}
  • sig/*
  • kind/feature

cc @idvoretskyi

[arunmk]

Hi @krmayankk,

Since your Enhancement is scheduled to be in 1.21, please keep in mind the important upcoming dates:

• Tuesday, March 9th: Week 9 - Code Freeze
• Tuesday, March 16th: Week 10 - Docs Placeholder PR deadline
  • If this enhancement requires new docs or modification to existing docs, please follow the steps in the Open a placeholder PR doc to open a PR against k/website repo.

As a reminder, please link all of your k/k PR(s) and k/website PR(s) to this issue so we can track them.

Thanks!

[arunmk]

Hi @krmayankk ,

Enhancements team is currently tracking the following PRs

• Promote RunAsGroup to GA kubernetes#94641
• Promote RunAsGroup e2e test to Conformance kubernetes#98645

With the PRs merged, can we mark this enhancement complete for code freeze or do you have other PR(s) that are being worked on as part of the release?

Thanks

[arunmk]

Hi @krmayankk , I see that the PRs linked to this ticket are merged. Could you mention if this KEP is done? If so, I can mark it done for the code freeze coming up on 3/9.

Thanks

[arunmk]

(Adding this as a note sent to all)

Hi @krmayankk ,

A friendly reminder that Code freeze is 3 days away, March 9th EOD PST

Any enhancements that are NOT code complete by the freeze will be removed from the milestone and will require an exception to be added back.

Please also keep in mind that if this enhancement requires new docs or modification to existing docs, you'll need to follow the steps in the Open a placeholder PR doc to open a PR against k/website repo by March 16th EOD PST

Thanks!

[krmayankk]

@arunmk yes i think this enhancement can be marked as done afaict. @tallclair @liggitt please confirm .

[krmayankk]

I believe this documentation needs some update, @arunmk do documentations fixes also need to be completed by coed freeze date ?

[arunmk]

@krmayankk i believe 3/16 is the deadline to have a placeholder doc and it should also include such documentation. Let me check with the team and confirm.

[arunmk]

Hi @krmayankk it is confirmed that we do NOT need docs to be updated by the code freeze on 3/9.

[annajung]

Hi @krmayankk 1.21 Enhancement Lead here.

Can you update the kep.yaml to reflect a status of implemented:

enhancements/keps/sig-node/213-run-as-group/kep.yaml

Line 19 in 29a891b

status: implementable

Once that merges, we can close out this issue.

[krmayankk]

@JamesLaverack can we now close this issue since its stable ?

[JamesLaverack]

Hey @krmayankk. The last thing is what Anna mentions above — setting the status to be implemented in your kep.yaml. It looks like there's already a PR for this in #2614, which has /closes on this issue too, so as soon as that is merged, this should be closed.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[krmayankk]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.