Skip to content

Commit

Permalink
docs: Fix typos (/priviledged/privileged/) (argoproj#4335)
Browse files Browse the repository at this point in the history
  • Loading branch information
tomgoren authored Oct 21, 2020
1 parent 37a2ae0 commit 36002a2
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 14 deletions.
16 changes: 8 additions & 8 deletions docs/workflow-executors.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,23 +13,23 @@ The executor to be used in your workflows can be changed in [the configmap](./wo
* Most well-tested
* Most popular
* Least secure:
* It requires `priviledged` access to `docker.sock` of the host to be mounted which. Often rejected by Open Policy Agent (OPA) or your Pod Security Policy (PSP).
* It requires `privileged` access to `docker.sock` of the host to be mounted which. Often rejected by Open Policy Agent (OPA) or your Pod Security Policy (PSP).
* It can escape the privileges of the pod's service account
* It cannot [`runAsNonRoot`](workflow-pod-security-context.md).
* Most scalable:
* It communicates directly with the local Docker daemon.
* Artifacts:
* Output artifacts can be located on the base layer (e.g. `/tmp`).
* Output artifacts can be located on the base layer (e.g. `/tmp`).
* Configuration:
* No additional configuration needed.

## Kubelet (kubelet)

* Reliability:
* Least well-tested
* Least well-tested
* Least popular
* Secure
* No `priviledged` access
* No `privileged` access
* Cannot escape the privileges of the pod's service account
* [`runAsNonRoot`](workflow-pod-security-context.md) - TBD, see [#4186](https://github.com/argoproj/argo/issues/4186)
* Scalable:
Expand All @@ -45,7 +45,7 @@ The executor to be used in your workflows can be changed in [the configmap](./wo
* Well-tested
* Popular
* Secure:
* No `priviledged` access
* No `privileged` access
* Cannot escape the privileges of the pod's service account
* Can [`runAsNonRoot`](workflow-pod-security-context.md)
* Least scalable:
Expand All @@ -58,10 +58,10 @@ The executor to be used in your workflows can be changed in [the configmap](./wo
## Process Namespace Sharing (pns)

* Reliability:
* Well-tested
* Well-tested
* Popular
* Secure:
* No `priviledged` access
* No `privileged` access
* cannot escape the privileges of the pod's service account
* Can [`runAsNonRoot`](workflow-pod-security-context.md), if you use volumes (e.g. [emptyDir](empty-dir.md)) for your output artifacts
* Scalable:
Expand Down
12 changes: 6 additions & 6 deletions docs/workflow-pod-security-context.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ By default, a workflow pods run as root. The Docker executor even requires `priv

For other [workflow executors](workflow-executors.md), you can run your workflow pods more securely by configuring the [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) for your workflow pod.

This is likely to be necessary if you have a [pod security policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). You probably can't use the Docker executor if you have a pod security policy.
This is likely to be necessary if you have a [pod security policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). You probably can't use the Docker executor if you have a pod security policy.

```yaml
apiVersion: argoproj.io/v1alpha1
Expand All @@ -15,13 +15,13 @@ spec:
securityContext:
runAsNonRoot: true
runAsUser: 8737 #; any non-root user
priviledged: false
privileged: false
```
You can configure this globally using [workflow defaults](default-workflow-specs.md).
!!! Warning "It is easy to make a workflow need root unintentionally"
You may find that user's workflows have been written to require root with seemingly innocuous code. E.g. `mkdir /my-dir` would require root.
You may find that user's workflows have been written to require root with seemingly innocuous code. E.g. `mkdir /my-dir` would require root.

!!! Note "You must use volumes for output artifacts"
If you use `runAsNonRoot` - you cannot have output artifacts on base layer (e.g. `/tmp`). You must use a volume (e.g. [empty dir](empty-dir.md)).
!!! Note "You must use volumes for output artifacts"
If you use `runAsNonRoot` - you cannot have output artifacts on base layer (e.g. `/tmp`). You must use a volume (e.g. [empty dir](empty-dir.md)).

0 comments on commit 36002a2

Please sign in to comment.