docker - openshift使用uid 101运行所有容器，而不是从项目范围获取uid

Question

使用以下文档安装Openshift集群:https://docs.openshift.com/container-platform/4.5/installing/installing_aws/installing-aws-default.html
在任何项目中运行Pod时-它总是以相同的UID 101启动:

$  oc run -it -n knative-serving --image busybox test1 sh
If you don't see a command prompt, try pressing enter.
~ $ id
uid=101(101) gid=0(root) groups=1000600000

当用户101已经存在于图像中时，这是一个问题-在这种情况下，它也具有GID 101，这会阻止访问FS(fs权限适用于GID 0)。

$  oc run -it -n kaiburr-app --image registry.kaiburr.com/dynamic-analysis-worker test3 sh
id
If you don't see a command prompt, try pressing enter.
id
uid=101(systemd-timesync) gid=101(systemd-timesync) groups=101(systemd-timesync),1000630000
$ ls -ld
drwxrwxr-x. 1 zap root 4096 Oct 19 19:24 .
$ touch test
touch: cannot touch 'test': Permission denied
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:105::/nonexistent:/usr/sbin/nologin
zap:x:1000:1000::/home/zap:/bin/bash

预期的行为是使用项目范围内的UID和GID 0创建容器。
Openshift已更新至最新版本:4.5.14
编辑:找到了由Nginx-ingress运算符创建的有问题的SCC

$ oc get scc nginx-ingress-scc -o yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities:
- NET_BIND_SERVICE
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  creationTimestamp: "2020-09-29T04:19:43Z"
  generation: 5
  managedFields:
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:allowHostDirVolumePlugin: {}
      f:allowHostIPC: {}
      f:allowHostNetwork: {}
      f:allowHostPID: {}
      f:allowHostPorts: {}
      f:allowPrivilegeEscalation: {}
      f:allowPrivilegedContainer: {}
      f:allowedCapabilities: {}
      f:defaultAddCapabilities: {}
      f:fsGroup:
        .: {}
        f:type: {}
      f:priority: {}
      f:readOnlyRootFilesystem: {}
      f:requiredDropCapabilities: {}
      f:runAsUser:
        .: {}
        f:type: {}
      f:seLinuxContext:
        .: {}
        f:type: {}
      f:supplementalGroups:
        .: {}
        f:type: {}
      f:users: {}
      f:volumes: {}
    manager: nginx-ingress-operator
    operation: Update
    time: "2020-09-29T04:26:51Z"
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:groups: {}
      f:runAsUser:
        f:uid: {}
    manager: oc
    operation: Update
    time: "2020-10-21T23:10:00Z"
  name: nginx-ingress-scc
  resourceVersion: "17079015"
  selfLink: /apis/security.openshift.io/v1/securitycontextconstraints/nginx-ingress-scc
  uid: ffe0c34c-9fe4-4cf6-9d57-eb919c90d42a
priority: 20
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAs
  uid: 101
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: MustRunAs
users:
- ingress-nginx:my-nginx-ingress-controller
volumes:
- secret

当我编辑此SCC并将UID更改为102时-所有新的Pod现在都使用UID 102创建。我注意到该SCC的优先级为20，但是任何uid SCC的优先级均为10。我将该Nginx SCC的优先级设置为5，并且UID行为现在似乎是anyuid(可能是因为我将所有内容都作为默认的临时管理员运行)，再也没有UID 101了!

Answer 1

通常，任何相关的uid都是由SCC在openshift中配置的，您始终可以使用oc describe scc来查看是否有任何SCC正在影响您的用户。
OP编辑:有关问题解决的更多详细信息，请参见问题本身。