kubernetes - SYS_TIME功能现已在Kubernetes中运行

Question

当我在下面的安全性上下文中创建具有更改系统时间权限的Pod时出现错误

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu-sleeper
  namespace: default
spec:
  containers:
  - command:
    - sleep
    - "4800"
    image: ubuntu
    securityContext:
     runAsUser: 1010
     capabilities:
        add: ["SYS_TIME"]
    name: ubuntu

我收到无法设置日期操作的错误消息。

master $ kubectl create -f ubu.yml
pod/ubuntu-sleeper created
master $ kubectl exec -it ubuntu-sleeper -- date -s '19 APR 2012 11:14:00'
date: cannot set date: Operation not permitted
Thu Apr 19 11:14:00 UTC 2012
command terminated with exit code 1
master $ 

Answer 1

要更改系统时间，必须以 super 用户身份运行容器:

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu-sleeper
  namespace: default
spec:
  containers:
  - command:
    - sleep
    - "4800"
    image: ubuntu
    securityContext:
     capabilities:
        add: ["SYS_TIME"]
    name: ubuntu