openshift使用uid 101运行所有容器，而不是从项目范围获取uid。

Question

在任何项目中运行pod时，Openshift集群都是使用下面的doc：https://docs.openshift.com/container-platform/4.5/installing/installing_aws/installing-aws-default.html安装的-它总是以相同的UID 101启动：

$  oc run -it -n knative-serving --image busybox test1 sh
If you don't see a command prompt, try pressing enter.
~ $ id
uid=101(101) gid=0(root) groups=1000600000

当用户101已经存在于图像中时，这是一个问题--在这种情况下，它也有一个GID 101，这阻止了访问FS (fs权限为GID 0)。

$  oc run -it -n kaiburr-app --image registry.kaiburr.com/dynamic-analysis-worker test3 sh
id
If you don't see a command prompt, try pressing enter.
id
uid=101(systemd-timesync) gid=101(systemd-timesync) groups=101(systemd-timesync),1000630000
$ ls -ld
drwxrwxr-x. 1 zap root 4096 Oct 19 19:24 .
$ touch test
touch: cannot touch 'test': Permission denied
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:105::/nonexistent:/usr/sbin/nologin
zap:x:1000:1000::/home/zap:/bin/bash

预期行为是使用来自项目范围和GID 0的UID创建容器。

Openshift更新为最新版本: 4.5.14

编辑:找到一个冒犯的SCC，由nginx-ingress操作符创建。

$ oc get scc nginx-ingress-scc -o yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities:
- NET_BIND_SERVICE
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  creationTimestamp: "2020-09-29T04:19:43Z"
  generation: 5
  managedFields:
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:allowHostDirVolumePlugin: {}
      f:allowHostIPC: {}
      f:allowHostNetwork: {}
      f:allowHostPID: {}
      f:allowHostPorts: {}
      f:allowPrivilegeEscalation: {}
      f:allowPrivilegedContainer: {}
      f:allowedCapabilities: {}
      f:defaultAddCapabilities: {}
      f:fsGroup:
        .: {}
        f:type: {}
      f:priority: {}
      f:readOnlyRootFilesystem: {}
      f:requiredDropCapabilities: {}
      f:runAsUser:
        .: {}
        f:type: {}
      f:seLinuxContext:
        .: {}
        f:type: {}
      f:supplementalGroups:
        .: {}
        f:type: {}
      f:users: {}
      f:volumes: {}
    manager: nginx-ingress-operator
    operation: Update
    time: "2020-09-29T04:26:51Z"
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:groups: {}
      f:runAsUser:
        f:uid: {}
    manager: oc
    operation: Update
    time: "2020-10-21T23:10:00Z"
  name: nginx-ingress-scc
  resourceVersion: "17079015"
  selfLink: /apis/security.openshift.io/v1/securitycontextconstraints/nginx-ingress-scc
  uid: ffe0c34c-9fe4-4cf6-9d57-eb919c90d42a
priority: 20
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAs
  uid: 101
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: MustRunAs
users:
- ingress-nginx:my-nginx-ingress-controller
volumes:
- secret

当我编辑这个SCC并将UID更改为102时，所有新的荚现在都用UID 102创建了。我注意到这个SCC有20优先级，但anyuid SCC有10。我将nginx SCC的优先级设置为5，现在的UID行为似乎是anyuid (可能，因为我作为默认的临时管理程序运行所有东西)，再也没有UID 101了！

Answer 1

通常任何与uid相关的配置都是由openshift中的SCC配置的，您可以始终使用oc describe scc来查看是否有任何SCC正在影响您的用户。

编辑OP:关于解决问题的更多细节，可以在问题本身找到。