使用非root用户在AKS中运行Pod失败的技术求助

此前在AKS中以root权限部署Docker镜像，Sonar测试提出合规性异议。改用非root用户运行Pod后，Pod启动失败。已在Dockerfile中创建非root用户，同时了解到可在AKS的deployment.yaml中配置Security Context，不确定应选择哪种方式，或是否需要在创建用户时添加额外权限。此外，Pod需要访问挂载为Volume的ConfigMap。

Dockerfile内容 #

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine AS build
WORKDIR /src
COPY ["WK.CO.Test.API/WK.CO.Test.API.csproj", "WK.CO.Test.API/"]
RUN dotnet restore "WK.CO.Test.API/WK.CO.Test.API.csproj"
COPY . .
WORKDIR "/src/WK.CO.Test.API"
RUN dotnet build "WK.CO.Test.API/WK.CO.Test.API.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "WK.CO.Test.API/WK.CO.Test.API.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# Create a group and user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
# Run as appuser user
USER appuser
ENTRYPOINT ["dotnet", "WK.CO.Test.API.dll"]

AKS部署文件（deployment.yaml）内容 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: testservice-deployment
  labels:
    app: testservice
spec:
  replicas: 1
  selector:
    matchLabels:
      app: testservice
  template:
    metadata:
      labels:
        app: testservice
    spec:
      containers:
      - name: testapi
        image: test.azurecr.io/testsvc:1.0.0
        ports:
        - containerPort: 80
        volumeMounts:
        - name: config-volume
          mountPath: /app/config
      volumes:
      - name: config-volume
        configMap:
          name: test-config

更新：Pod启动失败错误详情 #

containerStatuses:
  - containerID: containerd://77b18f19cc635d405c59c5d63baae8e4f745a91e8074217ed8334b0fd3d48387
    image: test.azurecr.io/testsvc:1.0.0
    imageID: test.azurecr.io/testsvc@sha256:07c0399a40e7c76590f44a5b34f35305d32024e66b32b851b829819ac0060058
    lastState:
      terminated:
        containerID: containerd://77b18f19cc635d405c59c5d63baae8e4f745a91e8074217ed8334b0fd3d48387
        exitCode: 137
        finishedAt: "2023-04-05T05:48:28Z"
        reason: Error
        startedAt: "2023-04-05T05:48:28Z"
    name: testapi
    ready: false
    restartCount: 3
    started: false
    state:
      waiting:
        message: back-off 40s restarting failed container=testapi pod=testservice-deployment-6fd454bcc4-gzqbh_testservices-test(c38c1cf0-6fa7-44bd-b550-532d019b2d97)
        reason: CrashLoopBackOff

内容的提问来源于stack exchange，提问作者prakashrajansakthivel