policy auth_error ai_generated true

错误：容器设置了 runAsNonRoot 但镜像将以 root 身份运行。PodSecurityPolicy：不允许特权容器。PodSecurityPolicy：allowedCapabilities 为空：丢弃所有能力

Error: container has runAsNonRoot and image will run as root. PodSecurityPolicy: Privileged containers are not allowed. PodSecurityPolicy: allowedCapabilities is empty: drop all capabilities

ID: policy/kubernetes-psp-privileged-container-blocked

其他格式: JSON · Markdown 中文 · English
82%修复率
87%置信度
1证据数
2024-01-10首次发现

版本兼容性

版本状态引入弃用备注
Kubernetes v1.24 (PSP deprecated, replaced by Pod Security Admission) active — — —
PodSecurityPolicy API v1beta1 active — — —
Open Policy Agent v3.0.0 active — — —

根因分析

PodSecurityPolicy（或 OPA/Gatekeeper 约束）拒绝了 Pod，因为容器镜像需要 root 或特权能力，与策略的 runAsNonRoot 要求和空的 allowedCapabilities 冲突。

English

A PodSecurityPolicy (or OPA/Gatekeeper constraint) denies the pod because the container image requires root or privileged capabilities, conflicting with the policy's runAsNonRoot requirement and empty allowedCapabilities.

generic

官方文档

https://kubernetes.io/docs/concepts/security/pod-security-policy/

解决方案

  1. 修改容器镜像以非 root 用户身份运行，在 Dockerfile 中添加 USER 指令：

FROM ubuntu:22.04
RUN useradd -m appuser
USER appuser
CMD ["/bin/bash"]
  2. 更新 PodSecurityPolicy 以允许所需的能力，或将 runAsNonRoot 设置为 false（如果工作负载确实需要 root），但首先评估安全影响。

无效尝试

常见但无效的做法:

  1. Setting 'runAsNonRoot: false' in the pod spec 60% 失败

    The PSP still requires runAsNonRoot: true, so the pod will be rejected again; also weakens security.

  2. Adding 'CAP_SYS_ADMIN' to the container's capabilities 80% 失败

    The PSP's allowedCapabilities is empty, so any capability addition is denied.

  3. Deleting the PodSecurityPolicy resource entirely 50% 失败

    In many clusters, PSP is enforced by an admission controller; deleting the policy may cause other security gaps or the cluster to reject all pods.