pub fn effective_run_as_user(
sc: Option<&SecurityContext>,
psc: Option<&PodSecurityContext>,
) -> Option<i64>Expand description
The effective runAsUser following kubelet precedence: the container
securityContext.runAsUser if set, else the pod securityContext.runAsUser. None
when neither pins a UID — the UID is then image-determined (the USER line) and
unknowable from the spec.
This is the single definition of effective-UID precedence, shared by
crate::invariants (INV-1, which keys “is root” on this) and
crate::secctx_compat (which keys read-compatibility on it) so the two can never
fork. “Is root” is effective_run_as_user(..) == Some(0) — never runAsNonRoot,
which the invariants may flip.