[//]: # (Confidential document)
[//]: # (01/05/2025)
[//]: # (v 1.7.3)

# Kubernetes  labs v1.7.3
## Secuirty :   Security Context  

A security context defines privilege and access control settings for a Pod or Container.
PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. 
Field values of container.securityContext take precedence over field values of PodSecurityContext.

## Lab1: Security context for a Pod

  - Create the Pod:
  - Use id to check 
    - uid 1000, which is the value of `runAsUser`
    - gid 3000, which is same as `runAsGroup` field
    - group 2000, is the value of `fsGroup`
  - If the `runAsGroup` was omitted the gid would
remain as 0(root) and the process will be able to interact with files that are owned by root(0) group and that have 
the required group permissions for root(0) group.
  - Use ps to check 
    - The processes are running as user 1000, which is the value of `runAsUser`
  - Use ls to check
    - The `/data/demo` directory has group ID 2000, which is the value of `fsGroup`
  - Create file and use ls to check
    - `testfile` has group ID 2000, which is the value of `fsGroup

```
kubectl apply -f manifests/pod-security-context-example.yaml
kubectl get pod pod-security-context-example
kubectl exec -it pod-security-context-example -- sh

# id
# ps
# cd /data
# ls -l
# cd demo
# echo hello > testfile
# ls -l
# exit

kubectl delete po pod-security-context-example
```


## Lab2: Security context for a Container

  - Create the Pod:
  - Use ps to check :
    - The output shows that the processes are running as user 2000. This is the value
of `runAsUser` specified for the Container. It overrides the value 1000 that is
specified for the Pod


```
kubectl apply -f manifests/container-security-context-example.yaml
kubectl get pod container-security-context-example
kubectl exec -it container-security-context-example -- sh

# ps aux
# exit

kubectl delete po container-security-context-example
```