13

I am using a Kubernetes cluster deployed through Google Container Engine (GKE) from the Google Cloud Developer's Console, cluster version 0.19.3. I would like to run a privileged container, like in the Kubernetes NFS Server example:

apiVersion: v1
kind: Pod
metadata:
  name: nfs-server
  labels:
    role: nfs-server
spec:
  containers:
    - name: nfs-server
      image: jsafrane/nfs-data
      ports:
        - name: nfs
          containerPort: 2049
      securityContext:
        privileged: true

Since the default Google Container Engine configuration does not allow privileged containers, the Kubernetes API imediately returns the following error:

Error from server: Pod "nfs-server" is invalid: spec.containers[0].securityContext.privileged: forbidden '<*>(0xc20a027396)true'

How can I allow privileged containers in my Google Container Engine cluster?

2 Answers 2

10

Update: Privileged mode is now enabled by default starting with the 1.1 release of Kubernetes which is now available in Google Container Engine.


Running privileged containers (including the NFS server in that example) isn't currently possible in Google Container Engine. We are looking at ways to solve this (adding a flag when creating your cluster to allow privileged containers; making privileged containers part of admission control; etc). For now, if you need to run privileged containers you'll need to launch your own cluster using the GCE provider.

4
  • 1
    Thanks for the update, hopefully this gets added soon!
    – Caleb
    Jun 29, 2015 at 20:28
  • Now that Kubernetes is 1.0, they talk about it in their docs here: kubernetes.io/v1.0/examples/nfs/README.html (Just for reference)
    – four43
    Oct 12, 2015 at 14:02
  • 1
    Google Container Engine still doesn't support privileged mode with the 1.0 Kubernetes release. It will support privileged mode once the 1.1 release is out where privileged mode is enabled by default. Oct 12, 2015 at 21:51
  • 1
    Update: Privileged mode is now enabled by default starting with the 1.1 release of Kubernetes which is now available in Google Container Engine. Nov 17, 2015 at 0:46
0

This post talk about that (look at the end).

5
  • That Github Issue addresses the allow_privileged flag for the deploy-it-yourself solution to a Salt provider (gce, aws, vagrant), but not for Google Container Engine (gke), which is a managed Google Cloud Platform service
    – Caleb
    Jun 29, 2015 at 21:19
  • He will need the allow_privileged=true to set up a cluster no ? I undestood it in the way you explain "your own cluster using the GCE provider". Am I wrong ? Jun 29, 2015 at 21:32
  • The kube-jenkins-imager project go on that way to able privileged (github.com/GoogleCloudPlatform/kube-jenkins-imager/blob/master/…). It's a gke project. It did run, but the tricks seems to not work for now. (Changes to clusters name maybe ?) Jun 29, 2015 at 21:52
  • 1
    GKE clusters (cloud.google.com/container-engine) are fully managed by Google. Robert works at Google and confirmed that they are working to expose the allow_privileged option, but it's not available yet.
    – Caleb
    Jun 30, 2015 at 1:21
  • 1
    I didn't understand because connecting to node, going to config and switching allow_privileged=true did the work on container engine. I did it for a month. BUT !, it seems that don't work anymore with the v0.19 of k8s. There is an introduction of managed master that break the trick. Jun 30, 2015 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.