Skip to content

Commit fee94ce

Browse files
everpeaceTim Bannister
andauthored
Apply suggestions from code review
Co-authored-by: Tim Bannister <[email protected]>
1 parent a8fa614 commit fee94ce

File tree

1 file changed

+6
-6
lines changed
  • content/en/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control

1 file changed

+6
-6
lines changed

content/en/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Let's see an example, below Pod specifies `runAsUser=1000`, `runAsGroup=3000` an
2121

2222
What is the result of `id` command in the `ctr` container?
2323

24-
```shell
24+
```console
2525
# Create the Pod:
2626
$ kubectl apply -f https://k8s.io/blog/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml
2727

@@ -42,7 +42,7 @@ Where does group ID `50000` in supplementary groups (`groups` field) come from,
4242

4343
Checking the contents of `/etc/group` in the container image should show below:
4444

45-
```shell
45+
```console
4646
$ kubectl exec implicit-groups -- cat /etc/group
4747
...
4848
user-defined-in-image:x:1000:
@@ -71,7 +71,7 @@ Let's see how `Strict` policy works.
7171

7272
{{% code_sample file="strict-supplementalgroups-policy.yaml" %}}
7373

74-
```shell
74+
```console
7575
# Create the Pod:
7676
$ kubectl apply -f https://k8s.io/blog/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml
7777

@@ -90,10 +90,10 @@ uid=1000 gid=3000 groups=3000,4000
9090

9191
You can see `Strict` policy can exclude group `50000` from `groups`!
9292

93-
Thus, enforcing `SupplementalGroupsPolicy=Merge` by some policy engines helps preventing the implicit supplementary groups in a Pod.
93+
Thus, ensuring `supplementalGroupsPolicy: Merge` (enforced by some policy mechanism) helps prevent the implicit supplementary groups in a Pod.
9494

9595
{{<note>}}
96-
Actually, this is not enough because container with strong priviledge/capability can change its process identity. Please see the following section for details).
96+
Actually, this is not enough because container with sufficient privileges / capability can change its process identity. Please see the following section for details.
9797
{{</note>}}
9898

9999
## Attached process identity in Pod status
@@ -153,7 +153,7 @@ the feature gate manually.
153153
## How can I learn more?
154154

155155
<!-- https://github.com/kubernetes/website/pull/46920 -->
156-
Please check out the [documentation](/content/en/docs/tasks/configure-pod-container/security-context/)
156+
Please check out the [documentation](/docs/tasks/configure-pod-container/security-context/)
157157
for the further details of `supplementalGroupsPolicy`.
158158

159159
## How to get involved?

0 commit comments

Comments
 (0)