[AWS Batch] [request]: support for complete Pod and Container level securityContext from EKS Job Definitions
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
We have users that are interested in utilizing the AWS Batch integration with EKS, but the configuration options available in Job Definition today don't cover enough of the Pod spec to allow their applications to comply with our organization's security posture. Today, it appears that [only some of the fields of the container level securityContext](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-batch-jobdefinition-ekscontainersecuritycontext.html) are available. Please consider adding more of the fields from both the [Pod](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#podsecuritycontext-v1-core) and [Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#securitycontext-v1-core) level fields.
For our use cases, the additional must have fields are:
- `capabilities.drop` from container
- `runAsUser` from pod (while this would be overridden by the container level field that is available, we're typically expected to set both to prevent injected containers from running without this configuration)
- `runAsNonRoot` from pod
- `runAsGroup` from pod
**Which service(s) is this request for?**
Support in AWS Batch for EKS Job Definitions
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
See above
**Are you currently working around this issue?**
Historically, our workaround has been not using AWS Batch for these types of use cases.
**Additional context**
For us to make use of this feature, it would need to be exposed via the relevant parts of the CloudFormation API.
**Attachments**
N/A
Contributor guide
Research direction
Start with the AWS Batch for EKS Job Definitions and the related CloudFormation API areas described in the issue. Confirm how to expose container capabilities.drop and pod runAsUser, runAsNonRoot, and runAsGroup; done means these fields are supported for the requested EKS Job Definition use cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100