# 错误：容器设置了 runAsNonRoot 但镜像将以 root 身份运行。PodSecurityPolicy：不允许特权容器。PodSecurityPolicy：allowedCapabilities 为空：丢弃所有能力

- **ID:** `policy/kubernetes-psp-privileged-container-blocked`
- **领域:** policy
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 82%

## 根因

PodSecurityPolicy（或 OPA/Gatekeeper 约束）拒绝了 Pod，因为容器镜像需要 root 或特权能力，与策略的 runAsNonRoot 要求和空的 allowedCapabilities 冲突。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Kubernetes v1.24 (PSP deprecated, replaced by Pod Security Admission) | active | — | — |
| PodSecurityPolicy API v1beta1 | active | — | — |
| Open Policy Agent v3.0.0 | active | — | — |

## 解决方案

1. ```
   修改容器镜像以非 root 用户身份运行，在 Dockerfile 中添加 USER 指令：

FROM ubuntu:22.04
RUN useradd -m appuser
USER appuser
CMD ["/bin/bash"]
   ```
2. ```
   更新 PodSecurityPolicy 以允许所需的能力，或将 runAsNonRoot 设置为 false（如果工作负载确实需要 root），但首先评估安全影响。
   ```

## 无效尝试

- **Setting 'runAsNonRoot: false' in the pod spec** — The PSP still requires runAsNonRoot: true, so the pod will be rejected again; also weakens security. (60% 失败率)
- **Adding 'CAP_SYS_ADMIN' to the container's capabilities** — The PSP's allowedCapabilities is empty, so any capability addition is denied. (80% 失败率)
- **Deleting the PodSecurityPolicy resource entirely** — In many clusters, PSP is enforced by an admission controller; deleting the policy may cause other security gaps or the cluster to reject all pods. (50% 失败率)