-
Notifications
You must be signed in to change notification settings - Fork 39.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PodSecurityStandards being enforced provide different log information for Deployments and for pods to the user #125507
Comments
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the The Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/sig Policy |
@cck1860: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/sig Security |
/sig auth |
/assign @stlaz |
Enforcement is actually not run on the pod controllers (such as Deployment), meaning that the enforce label is ignored and only the "warn" label applies for client-side warnings. On the contrary, the warn-level admission is not run when the enforcement fails. @liggitt you added this code originally, does running the warn admission on a pod that already failed the enforcement check make sense? Or, perhaps from the other side, should we run enforcement at warn level for pod controllers, and then running the warn admission again? |
/remove-kind bug The reason we only issue warnings at the controller level is because we don't know the pod will be disallowed until a creation is actually attempted and any mutating admission plugins interact with the create attempt.
|
@liggitt: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Rejecting the pod (enforce) takes precedence over warning. |
What happened?
I set up a namespace as described in the documentation example:
When trying to make a request to deploy the following:
I am only getting the warnings restricted specification violation:
The deployment resource is generated and the pods are not spinned up due to the violation of the baseline standard (because of the hostNetwork:true setting).
I expected to get here also a message that the deployment is not possible due to this violation. - When I am deploying just a pod with the same configuration:
kubectl apply -f nginx-pod.yml -n my-baseline-namespace
Error from server (Forbidden): error when creating "nginx-pod.yml": pods "nginx" is forbidden: violates PodSecurity "baseline:v1.30": host namespaces (hostNetwork=true)
I wonder, if deployments should behave in the same way as the pods being configured like shown below:
What did you expect to happen?
I expected to get the same message for deployment resources like I am getting it for pods for the kubectl output.
Also when running kubectl describe deployment nginx, there is no further hint regarding to PodSecurityStandards why the pods are not started:
kubectl describe deployment nginx-deployment -n my-baseline-namespace
Name: nginx-deployment
Namespace: my-baseline-namespace
CreationTimestamp: Fri, 14 Jun 2024 11:31:35 +0200
Labels:
Annotations: deployment.kubernetes.io/revision: 1
Selector: app=nginx
Replicas: 2 desired | 0 updated | 0 total | 0 available | 2 unavailable
StrategyType: RollingUpdate
MinReadySeconds: 0
RollingUpdateStrategy: 25% max unavailable, 25% max surge
Pod Template:
Labels: app=nginx
Containers:
nginx:
Image: nginx:1.14.2
Port: 80/TCP
Host Port: 0/TCP
Environment:
Mounts:
Volumes:
Node-Selectors:
Tolerations:
Conditions:
Type Status Reason
Available False MinimumReplicasUnavailable
ReplicaFailure True FailedCreate
Progressing False ProgressDeadlineExceeded
OldReplicaSets:
NewReplicaSet: nginx-deployment-7cc7dc59f6 (0/2 replicas created)
Events:
How can we reproduce it (as minimally and precisely as possible)?
The yaml files are posted above, I deployed this on a Minikube Kubernetes 1.30.2
Anything else we need to know?
No response
Kubernetes version
Cloud provider
Not applicable
OS version
Install tools
Container runtime (CRI) and version (if applicable)
Related plugins (CNI, CSI, ...) and versions (if applicable)
/wg Policy
The text was updated successfully, but these errors were encountered: