ccu, Administrators
684
edits
Changes
Jump to navigation
Jump to search
m
→User namespace, pod security and quotas
=== User namespace, pod security and quotas ===
Each user works in their own namespace now, which is auto-generated when your login is created. The naming convention is "as follows: Login ID : firstname.lastnameUsername : firstname-lastnameNamespace: user-firstname-lastname", i.e. That means you replace all '.'s in your cluster username with login ID '-'. Example: if your to obtain the username is "test.account", your namespace will be and prepend "user-test-account"to obtain the namespace.
Thus, you should set your default namespace in the kubeconfig accordingly, and perhaps have to update pod configurations. For security reasons, containers are forced to run with your own user id and a user group id of "10000". These will also be the ids used to create files and directories, and decide the permissions you have on the file system. The pod security policy which is active for your namespace will automatically fill in this data. Note that the security policy for pods is very restrictive for now to detect all problematic cases. In particular, you can not switch to root inside containers anymore. Please inform me if security policies disrupt your usual workflow so that we can work something out.
