Kubernetes 命令和 args 语法问题

Question

我正在尝试以非特权身份运行 nginx 映像，并找到了执行此操作所需的以下命令节。我不关心运行官方的 nginx-unprivileged 镜像，因为这会破坏练习的目的（不要问为什么......请）。

从 linux 终端样式转换为 Kubernetes YAML Pod 清单 init-container 部分的预期命令...

RUN sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
    && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
    && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
    && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \
    && chown -R 101:0 /var/cache/nginx \
    && chmod -R g+w /var/cache/nginx \
    && chown -R 101:0 /etc/nginx \
    && chmod -R g+w /etc/nginx

我尝试了以下使用块标量无济于事...

...
command: ["/bin/sh", "-c"]
args: 
- >
  sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
  && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
  && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
  && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \
  && chown -R 101:0 /var/cache/nginx \
  && chmod -R g+w /var/cache/nginx \
  && chown -R 101:0 /etc/nginx \
  && chmod -R g+w /etc/nginx
...


...
command: ["/bin/sh", "-c"]
args: 
- |
  sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
  && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
  && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
  && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \
  && chown -R 101:0 /var/cache/nginx \
  && chmod -R g+w /var/cache/nginx \
  && chown -R 101:0 /etc/nginx \
  && chmod -R g+w /etc/nginx
...

同样使用单行...

...
    command: ["/bin/sh"]
    args: ["-c", "sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf && chown -R 101:0 /var/cache/nginx && chmod -R g+w /var/cache/nginx && chown -R 101:0 /etc/nginx && chmod -R g+w /etc/nginx"]
...

这些都不起作用...初始化容器永远不会启动。

这是另一个尝试...但 initContainer 仍处于 crashloopbackoff 状态...

apiVersion: v1
kind: Pod
metadata:
  name: securityreview
spec:
  securityContext:
    runAsUser: 101
    runAsNonRoot: True
  initContainers:
  - name: permission-fix
    image: nginx
    command:
    - /bin/sh
    - -c
    - sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf
      && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf
      && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf
      && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    
      fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    
      scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf
      && chown -R 101:0 /var/cache/nginx && chmod -R g+w /var/cache/nginx
      && chown -R 101:0 /etc/nginx && chmod -R g+w /etc/nginx
  containers:
  - name: webguy
    image: nginx
    securityContext:
      runAsUser: 101
      runAsGroup: 101
      allowPrivilegeEscalation: false

Answer 1

我喜欢使用以下方法以可读的方式分隔多个命令：

command: ["/bin/sh", "-c"]
args:
  - >
    command1 &&
    command2 &&
    ...
    commandN

但是，您的情况更复杂，因为在没有 root 权限的情况下运行 sed、chown 和 chmod 命令将导致 Permission denied 错误。

您可以使用与 nginx 容器共享 Volume 的 init 容器。 init 容器将运行sed、chown 和chmod 命令作为root，然后将修改后的文件复制到将由 nginx 容器挂载和使用的共享卷。在这种方法中，您需要一个可供 init 和应用程序容器使用的卷。
在Configure Pod Initialization 文档中可以找到类似的用例。

我将创建一个示例来说明它是如何工作的。

---

正如您在下面的代码 sn-p 中看到的，我创建了 permission-fix init 容器，它运行所需的命令，然后将修改后的文件复制到共享卷 (cp -Rp /etc/nginx/* /mnt/nginx-fix/)。然后webguy 容器将这些文件挂载到/etc/nginx：

$ cat nginx-unpriv.yml
apiVersion: v1
kind: Pod
metadata:
  name: securityreview
spec:
  initContainers:
  - name: permission-fix
    image: nginx
    command: ["/bin/sh", "-c"]
    args:
      - >
        sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf &&
        sed -i '/user  nginx;/d' /etc/nginx/nginx.conf &&
        sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf &&
        sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf &&
        chown -R 101:0 /var/cache/nginx &&
        chmod -R g+w /var/cache/nginx &&
        chown -R 101:0 /etc/nginx &&
        chmod -R g+w /etc/nginx &&
        cp -Rp /etc/nginx/* /mnt/nginx-fix/
    volumeMounts:    
    - name: nginx-fix
      mountPath: "/mnt/nginx-fix"
  containers:
  - name: webguy
    image: nginx
    volumeMounts:
    - name: nginx-fix
      mountPath: "/etc/nginx"
    securityContext:
      runAsUser: 101
      runAsGroup: 101
      allowPrivilegeEscalation: false
  volumes:
    - name: nginx-fix
      persistentVolumeClaim:
        claimName: myclaim

我们可以检查它是否按预期工作：

$ kubectl apply -f nginx-unpriv.yml
pod/securityreview created

$ kubectl get pods
NAME             READY   STATUS    RESTARTS   AGE
securityreview   1/1     Running   0          12s

$ kubectl exec -it securityreview  -c webguy -- bash
nginx@securityreview:/$ id
uid=101(nginx) gid=101(nginx) groups=101(nginx)

nginx@securityreview:/$ ls -l /etc/nginx
total 44
drwxrwxr-x 2 nginx root  4096 Jun 10 13:18 conf.d
-rw-rw-r-- 1 nginx root  1007 May 25 12:28 fastcgi_params
drwx------ 2 root  root 16384 Jun 10 13:18 lost+found
-rw-rw-r-- 1 nginx root  5290 May 25 12:28 mime.types
lrwxrwxrwx 1 nginx root    22 May 25 13:01 modules -> /usr/lib/nginx/modules
-rw-rw-r-- 1 nginx root   826 Jun 10 13:18 nginx.conf
-rw-rw-r-- 1 nginx root   636 May 25 12:28 scgi_params
-rw-rw-r-- 1 nginx root   664 May 25 12:28 uwsgi_params

如果此回复没有回答您的问题，请提供有关您想要实现的目标的更多详细信息。

Answer 2

以下文件将运行..但用户 'nginx' 仍然缺少权限； kubernetes 也无法识别“&&”。

apiVersion: v1
kind: Pod
metadata:
  name: securityreview
spec:
  securityContext:
    runAsUser: 101
    runAsNonRoot: True
  containers:
  - name: webguy
    image: nginx
    command:
        - "/bin/sh"
    args:
        - "-c"
        - |
          sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf
          && sed -i '/user  nginx;/d' /etc/nginx/nginx.conf
          && sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf
          && sed -i "/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf
          && chown -R 101:0 /var/cache/nginx
          && chmod -R g+w /var/cache/nginx
          && chown -R 101:0 /etc/nginx
          && chmod -R g+w /etc/nginx
    securityContext:
      runAsUser: 101
      runAsGroup: 101
      allowPrivilegeEscalation: false