Starting/Stopping services in a host as part of K8S pod deployment

8/31/2018

We run K8S clusters based on custom VM images that have corporate standard services and utilities. How can a pod/container have access to those? For example, how to start a service in the host as part of deploy/undeploy

-- user2991054
amazon-ec2
amazon-web-services
kubernetes

1 Answer

9/1/2018

You can mount the systemd sockets into the Pod's container. From there you either need polkit permissions to run the commands as a non privileged user, or you need to run the container privileged. The Pod spec to do so is as follows:

kind: Pod
metadata:
  name: dbus-pod
  labels:
    app: dbus
spec:
  containers:
  - name: dbus-container
    image: centos:7
    command: ['systemctl','status','sshd']
    securityContext:
      privileged: true
    volumeMounts:
    - name: run-dbus
      mountPath: /var/run/dbus
    - name: run-systemd
      mountPath: /run/systemd
    - name: bin-systemctl
      mountPath: /usr/bin/systemctl
      readOnly: true
    - name: etc-systemd
      mountPath: /etc/systemd/system
      readOnly: true
  restartPolicy: Never
  volumes:
  - name: run-dbus
    hostPath:
    path: /var/run/dbus
  - name: run-systemd
    hostPath:
    path: /run/systemd
  - name: bin-systemctl
    hostPath:
    path: /usr/bin/systemctl
  - name: etc-systemd
    hostPath:
    path: /etc/systemd/system

Then you have to figure out how you want to schedule the Pod on your cluster. If you wanted to run something on every node once, you could create a DaemonSet and remove it. A Job might be more appropriate if you have selectors to define where you want the Pod to run.

There are also projects like go-systemd that control dbus via the /var/run/dbus socket and take the place of all the systemd/systemctl setup.

-- Matt
Source: StackOverflow