security context

.vuepress/config.js

@@ -322,10 +322,11 @@ module.exports = {
                   collapsable: true,
                   children: [
                     'k8s-intermediate/config/sec-ctx/',
-                    // 'k8s-intermediate/config/sec-ctx/pod',
-                    // 'k8s-intermediate/config/sec-ctx/con',
-                    // 'k8s-intermediate/config/sec-ctx/con-cap',
-                    // 'k8s-intermediate/config/sec-ctx/con-sel',
+                    'k8s-intermediate/config/sec-ctx/pod',
+                    'k8s-intermediate/config/sec-ctx/con',
+                    'k8s-intermediate/config/sec-ctx/con-cap',
+                    'k8s-intermediate/config/sec-ctx/con-sel',
+                    'k8s-intermediate/config/sec-ctx/volumes',
                   ]
                 },
               ]

.vuepress/public/statics/learning/sec-ctx/security-context-1.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: security-context-demo
+spec:
+  securityContext:
+    runAsUser: 1000
+    runAsGroup: 3000
+    fsGroup: 2000
+  volumes:
+  - name: sec-ctx-vol
+    emptyDir: {}
+  containers:
+  - name: sec-ctx-demo
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]
+    volumeMounts:
+    - name: sec-ctx-vol
+      mountPath: /data/demo
+    securityContext:
+      allowPrivilegeEscalation: false

.vuepress/public/statics/learning/sec-ctx/security-context-2.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: security-context-demo-2
+spec:
+  securityContext:
+    runAsUser: 1000
+  containers:
+  - name: sec-ctx-demo-2
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]
+    securityContext:
+      runAsUser: 2000
+      allowPrivilegeEscalation: false

.vuepress/public/statics/learning/sec-ctx/security-context-3.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: security-context-demo-3
+spec:
+  containers:
+  - name: sec-ctx-demo-3
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]

.vuepress/public/statics/learning/sec-ctx/security-context-4.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: security-context-demo-4
+spec:
+  containers:
+  - name: sec-ctx-demo-4
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]
+    securityContext:
+      capabilities:
+        add: ["NET_ADMIN", "SYS_TIME"]