Skip to content

Commit edd8ab3

Browse files
committed
KEP-3619: addresses review feedbakcks
1 parent c5f020c commit edd8ab3

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

content/en/docs/tasks/configure-pod-container/security-context.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -162,8 +162,7 @@ exit
162162

163163
### Implicit group memberships defined in `/etc/group` in the container image
164164

165-
By default, kubernetes merges group information for the container's primary user defined in
166-
`/etc/group` in the container image.
165+
By default, kubernetes merges group information from the Pod with information defined in `/etc/group` in the container image.
167166

168167
{{% code_sample file="pods/security/security-context-5.yaml" %}}
169168

@@ -198,22 +197,22 @@ $ id
198197
The output is similar to this:
199198

200199
```none
201-
uid=1000(user-defined-in-image) gid=3000 groups=3000,4000,50000(group-defined-in-image)
200+
uid=1000 gid=3000 groups=3000,4000,50000
202201
```
203202

204-
You can see `groups` includes group ID `50000`. This is because the user (`uid=1000(user-defined-in-image)`)
205-
belongs to the group `group-defined-in-image(gid=50000)` which is defined in `/etc/group` in the container image.
203+
You can see `groups` includes group ID `50000`. This is because the user (`uid=1000`), which is defined in the image, belongs to the group (`gid=50000`), which is defined in `/etc/group` inside the container image.
206204

207205
Check the `/etc/group` in the container image:
208206

209207
```shell
210208
$ cat /etc/group
211209
```
212210

213-
You can see the group entry that `user-defined-in-image(uid=1000)` belongs to `group-defined-in-image(gid=50000)`.
211+
You can see that uid `1000` belongs to group `50000`.
214212

215213
```none
216214
...
215+
user-defined-in-image:x:1000:
217216
group-defined-in-image:x:50000:user-defined-in-image
218217
```
219218

@@ -272,7 +271,7 @@ kubectl exec -it security-context-demo -- id
272271
The output is similar to this:
273272

274273
```none
275-
uid=1000(user-defined-in-image) gid=3000 groups=3000,4000
274+
uid=1000 gid=3000 groups=3000,4000
276275
```
277276

278277
See the Pod's status:

0 commit comments

Comments
 (0)