提交 189d7efe 编写于 作者: P Piotr Bryk

Merge pull request #199 from bryk/run-privileged

Add run as privileged option to the deploy form
......@@ -57,6 +57,9 @@ type AppDeploymentSpec struct {
// Labels that will be defined on Pods/RCs/Services
Labels []Label `json:"labels"`
// Whether to run the container as privileged user (essentially equivalent to root on the host).
RunAsPrivileged bool `json:"runAsPrivileged"`
}
// Port mapping for an application deployment.
......@@ -99,6 +102,9 @@ func DeployApp(spec *AppDeploymentSpec, client client.Interface) error {
containerSpec := api.Container{
Name: spec.Name,
Image: spec.ContainerImage,
SecurityContext: &api.SecurityContext{
Privileged: &spec.RunAsPrivileged,
},
}
if spec.ContainerCommand != nil {
......
......@@ -52,7 +52,8 @@ backendApi.Label;
* portMappings: !Array<!backendApi.PortMapping>,
* labels: !Array<!backendApi.Label>,
* replicas: number,
* namespace: string
* namespace: string,
* runAsPrivileged: boolean,
* }}
*/
backendApi.AppDeploymentSpec;
......
......@@ -129,11 +129,20 @@ limitations under the License.
</md-input-container>
</div>
<kd-user-help>
By default, your containers run the selected image's default entrypoint command. You can use the
command options to override the default.
By default, your containers run the selected image's default entrypoint command. You can
use the command options to override the default.
<a href="">Learn more</a>
</kd-user-help>
</kd-help-section>
<kd-help-section>
<md-switch ng-model="ctrl.runAsPrivileged" class="md-primary">
Run as privileged
</md-switch>
<kd-user-help>
Processes in privileged containers are equivalent to be running as root on the host.
</kd-user-help>
</kd-help-section>
</div>
<md-button class="md-primary kd-deploy-moreoptions-button" type="button"
......
......@@ -94,6 +94,12 @@ export default class DeployFromSettingsController {
*/
this.name;
/**
* Whether to run the container as privileged user.
* @export {boolean}
*/
this.runAsPrivileged = false;
/**
* Currently chosen namespace.
* @export {string}
......@@ -136,6 +142,7 @@ export default class DeployFromSettingsController {
replicas: this.replicas,
namespace: this.namespace,
labels: this.toBackendApiLabels_(this.labels),
runAsPrivileged: this.runAsPrivileged,
};
let defer = this.q_.defer();
......
......@@ -26,6 +26,7 @@ func TestDeployApp(t *testing.T) {
spec := &AppDeploymentSpec{
Namespace: namespace,
Name: "foo-name",
RunAsPrivileged: true,
}
expectedRc := &api.ReplicationController{
ObjectMeta: api.ObjectMeta{
......@@ -43,6 +44,9 @@ func TestDeployApp(t *testing.T) {
Spec: api.PodSpec{
Containers: []api.Container{{
Name: "foo-name",
SecurityContext: &api.SecurityContext{
Privileged: &spec.RunAsPrivileged,
},
}},
},
},
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册