How deeply does Google Anthos in Action cover security context?

Defines user, group, filesystem-group, and privileged settings with runtime demonstrations, but defers cluster-wide enforcement to policy tools.

Security context

As explained in Google Anthos in Action

A Kubernetes security context is a pod or container specification field that controls identity, privilege, and filesystem security settings at runtime.

A Kubernetes security context controls the identity, group membership, filesystem group, and host privileges available to a container at runtime. Apply least privilege because a container breakout can expose host resources when the process runs as root. section 13.6.1 section 13.6.2

Configure the context to control two distinct security dimensions:

Set runAsUser, runAsGroup, and fsGroup to run the container with a specified user, group, and filesystem group. section 13.6.1
Set privileged to allow or deny elevated host privileges; privilege alone does not give a nonroot user permission to change kernel settings. section 13.6.2
Treat root execution and privileged containers as separate controls, then define cluster policies to prevent unsafe combinations. section 13.6.2

spec:
 securityContext:
   runAsUser: 1500
   runAsGroup: 1000
   fsGroup: 1200

Use the manifest listing to see a Pod securityContext assigning UID 1500, group 1000, and filesystem group 1200. section 13.6.1

Privilege and user identity are independent

A busybox Pod running as root without privileged access cannot change host kernel settings. Allowing privileged access enables those changes for root, while a privileged container running as user 1000 remains denied. section 13.6.2

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Spring Security in Action, Second EditionA security context is a Spring Security object that holds authentication information associated with the current execution or request.
liveBook manning.com

Kubernetes for DevelopersA Kubernetes security context is a set of Pod or container settings that controls security-related execution properties such as the user identity.
liveBook manning.com

Quarkus in ActionA security context is information describing the authenticated principal and associated security state for a request or interaction.

Compare how 4 books explain security context →

Related concepts

thread localuses · Thread-local data is data whose value or instance is independently associated with each executing thread.
authentication filterconfigured by · An authentication filter is a request-processing component that intercepts authentication requests and delegates them to an authentication mechanism.
privileged containerconfigures · A privileged container is a container granted broad host-level permissions or capabilities that substantially reduce its normal isolation from the host.
SecurityContextHolderused by · SecurityContextHolder is a Spring Security utility that provides access to the security context associated with the current execution.
non-root userconfigures · A non-root user is an operating-system account without the unrestricted administrative privileges of the root or superuser account.
authenticationhas part · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.