openshift 是 运行 所有 uid 为 101 的容器，而不是从项目范围中获取 uid

Question

使用此文档安装 Openshift 集群：https://docs.openshift.com/container-platform/4.5/installing/installing_aws/installing-aws-default.html 当 运行 任何项目中的 pod - 它始终以相同的 UID 101 启动：

$  oc run -it -n knative-serving --image busybox test1 sh
If you don't see a command prompt, try pressing enter.
~ $ id
uid=101(101) gid=0(root) groups=1000600000

当用户 101 已经存在于映像中时，这是一个问题 - 在这种情况下，它也有一个 GID 101，这会阻止访问 FS（fs 权限适用于 GID 0）。

$  oc run -it -n kaiburr-app --image registry.kaiburr.com/dynamic-analysis-worker test3 sh
id
If you don't see a command prompt, try pressing enter.
id
uid=101(systemd-timesync) gid=101(systemd-timesync) groups=101(systemd-timesync),1000630000
$ ls -ld
drwxrwxr-x. 1 zap root 4096 Oct 19 19:24 .
$ touch test
touch: cannot touch 'test': Permission denied
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:105::/nonexistent:/usr/sbin/nologin
zap:x:1000:1000::/home/zap:/bin/bash

预期的行为是使用项目范围内的 UID 和 GID 0 创建容器。

Openshift更新到最新版本：4.5.14

编辑：发现一个有问题的 SCC，由 nginx-ingress 操作员创建

$ oc get scc nginx-ingress-scc -o yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities:
- NET_BIND_SERVICE
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  creationTimestamp: "2020-09-29T04:19:43Z"
  generation: 5
  managedFields:
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:allowHostDirVolumePlugin: {}
      f:allowHostIPC: {}
      f:allowHostNetwork: {}
      f:allowHostPID: {}
      f:allowHostPorts: {}
      f:allowPrivilegeEscalation: {}
      f:allowPrivilegedContainer: {}
      f:allowedCapabilities: {}
      f:defaultAddCapabilities: {}
      f:fsGroup:
        .: {}
        f:type: {}
      f:priority: {}
      f:readOnlyRootFilesystem: {}
      f:requiredDropCapabilities: {}
      f:runAsUser:
        .: {}
        f:type: {}
      f:seLinuxContext:
        .: {}
        f:type: {}
      f:supplementalGroups:
        .: {}
        f:type: {}
      f:users: {}
      f:volumes: {}
    manager: nginx-ingress-operator
    operation: Update
    time: "2020-09-29T04:26:51Z"
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:groups: {}
      f:runAsUser:
        f:uid: {}
    manager: oc
    operation: Update
    time: "2020-10-21T23:10:00Z"
  name: nginx-ingress-scc
  resourceVersion: "17079015"
  selfLink: /apis/security.openshift.io/v1/securitycontextconstraints/nginx-ingress-scc
  uid: ffe0c34c-9fe4-4cf6-9d57-eb919c90d42a
priority: 20
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAs
  uid: 101
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: MustRunAs
users:
- ingress-nginx:my-nginx-ingress-controller
volumes:
- secret

当我编辑此 SCC 并将 UID 更改为 102 时 - 所有新 pods 现在都使用 UID 102 创建。我注意到此 SCC 的优先级为 20，但 anyuid SCC 的优先级为 10。我将优先级设置为nginx SCC 到 5 并且 UID 行为现在似乎是 anyuid（可能是因为我 运行 一切都是默认的临时管理员），不再有 UID 101！

Answer 1

通常任何与 uid 相关的东西都是由 openshift 中的 SCC 配置的，您可以随时使用 oc describe scc 查看是否有任何 SCC 正在影响您的用户。

OP 编辑​​：有关问题解决方案的更多详细信息，请参见问题本身。