Start new K8s Pod within K8s Pod without "Privileges"

7/23/2018

Good day,

I have quite a problem.

In our K8s Cluster should be a Simulations Starter Service (= "Master Pod") that can create Pods (= "Child Pods"). For each new request (in this case something like "start simulation") the Service starts a new simulation pod.

Also, I don't have extra privileges like "Privileged" (Pod Security Policies). We know we could connect to the same cluster by setting the kubernetes context and use kubectl in the Master Pod. But this is quite hacky and ugly since the Master Pod now would have a hell lot of power over the cluster (and so himself). Power he wouldn't really need and this can't be best practice.

I am new to kubernetes and docker (started to discover them a week ago) and its a pretty tough task for me I may say.

Any ideas appreciated!

Edit: I checked Google and StackOverflow search and didn't really find anything.

-- HansZimmer5000
authentication
docker
kubernetes

2 Answers

7/24/2018

This can be done with Kubernetes API.

There are many Officially-supported Kubernetes client libraries:

Go - github.com/kubernetes/client-go/

Python - github.com/kubernetes-client/python/

Java - github.com/kubernetes-client/java

dotnet - github.com/kubernetes-client/csharp

JavaScript - github.com/kubernetes-client/javascript

There are also many community supported ones which are listed here.

As an example, we can use official python client library.

Installation:

git clone --recursive https://github.com/kubernetes-client/python.git
cd python
python setup.py install

From PyPi directly:

pip install kubernetes

And use this example deployment script.

Detailed installation, requirements and usage is available here.

-- Crou
Source: StackOverflow

7/26/2018

So my colleague found something. Job Queueing. I think thats exactly what we wanted and actually it just kinda needs rights (depends on your specific deployment) to deploy but after that works just fine.

I was to focused on pods, so I completely missed the existence of Jobs.

If someone comes along here, try out their job queueing tutorial with Rabbitmq in their Github Repository.

Thanks!

-- HansZimmer5000
Source: StackOverflow