Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow pod sec context to be overridden #528

Merged
merged 1 commit into from
Jun 21, 2019
Merged

Allow pod sec context to be overridden #528

merged 1 commit into from
Jun 21, 2019

Conversation

skonto
Copy link
Contributor

@skonto skonto commented Jun 21, 2019

Address partially #505, at least on Openshift.

@skonto skonto force-pushed the override-sec branch 3 times, most recently from 3223578 to 3a335a1 Compare June 21, 2019 14:32
skonto
skonto commented Jun 21, 2019
View reviewed changes
main.go Outdated
metricsEndpoint = flag.String("metrics-endpoint", "/metrics", "Metrics endpoint.")
metricsPrefix = flag.String("metrics-prefix", "", "Prefix for the metrics.")
ingressUrlFormat = flag.String("ingress-url-format", "", "Ingress URL format.")
master = flag.String("master", "", "The address of the Kubernetes API server. Overrides any value in kubeconfig. Only required if out-of-cluster.")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go fmt ./... reformatted this.

liyinan926
liyinan926 reviewed Jun 21, 2019
View reviewed changes
main.go Outdated
metricsPort = flag.String("metrics-port", "10254", "Port for the metrics endpoint.")
metricsEndpoint = flag.String("metrics-endpoint", "/metrics", "Metrics endpoint.")
metricsPrefix = flag.String("metrics-prefix", "", "Prefix for the metrics.")
overridePodSecContext = flag.Bool("override-pod-sec-context", false, "Whether to override existing pod security context with patching.")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need a flag to control this. Always overriding as long as users explicitly specify a PodSecurityContext in their SparkApplications seems fine to me.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok sure I had it this way but was not sure if people want more control.

@skonto
Copy link
Contributor Author

skonto commented Jun 21, 2019

@liyinan926 ready to merge. :)

@liyinan926 liyinan926 merged commit 5f82fd7 into kubeflow:master Jun 21, 2019
@Reamer
Copy link

Reamer commented Jun 26, 2019 •
edited
Loading

For people who still have problems to get it working.
If you on Openshift. You must enable ValidatingAdmissionWebhook and MutatingAdmissionWebhook.
Howto: openshift/openshift-ansible#7983 (comment)

@anandbabus01
Copy link

I'm still facing problem. add below values along with memory and core but sill driver and executor runs in root user.

spec:
  driver:
    securityContext:
      runAsUser: 1000    
  executor:
    securityContext:
      runAsUser: 1000

web-hook service is running in spark-operator name space. now using below command to deploy spark app.
kubectl apply -f spark/template/spark-application.yaml.

any help appreciated.

akhurana001 pushed a commit to lyft/spark-on-k8s-operator that referenced this pull request May 5, 2020
@skonto
allow pod sec context to be overriden (kubeflow#528)
aaf8374
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liyinan926 liyinan926 liyinan926 left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@skonto @Reamer @anandbabus01 @liyinan926