ssh ckad00029
You must modify the existing Deployment store-deployment in namespace grubworm so that its containers:
And you’re told to use the manifest file at:
/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looks misspelled; follow it exactly on the host)
1) Inspect the current Deployment and locate the manifest file
kubectl -n grubworm get deploy store-deployment
ls -l /home/candidate/daring-moccasin/
Open the manifest:
sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"
2) Edit the manifest to add SecurityContext
Edit the file:
vi "/home/candidate/daring-moccasin/store-deplovment.vaml"
2.1 Set Pod-level runAsUser = 10000
Under:
spec.template.spec add:
securityContext:
runAsUser: 10000
2.2 Add NET_BIND_SERVICE capability at container-level
Under the container spec (for each container in containers:), add:
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
A complete example of what it should look like (mind indentation):
apiVersion: apps/v1
kind: Deployment
metadata:
name: store-deployment
namespace: grubworm
spec:
template:
spec:
securityContext:
runAsUser: 10000
containers:
- name: store
image: someimage
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
Important notes:
runAsUser can be set at Pod level (applies to all containers) or per-container. Pod-level is cleanest if all containers should run as 10000.
Capabilities must be set per-container (that’s where Kubernetes supports it).
Save and exit.
3) Apply the updated manifest
kubectl apply -f "/home/candidate/daring-moccasin/store-deplovment.vaml"
4) Ensure the Deployment rolls out
kubectl -n grubworm rollout status deploy store-deployment
5) Verify the settings are in effect
Check the rendered pod template:
kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.securityContext}{"\n"}'
kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.containers[0].securityContext}{"\n"}'
Verify on a running pod:
kubectl -n grubworm get pods
kubectl -n grubworm describe pod | sed -n '/Security Context:/,/Containers:/p'
kubectl -n grubworm describe pod | sed -n '/Containers:/,/Conditions:/p'
If there are multiple containers
Repeat the container-level securityContext.capabilities.add block for each container under spec.template.spec.containers.
