Change:
The type has a field called to indicate that a container must run as non-root user. The description for this field includes the sentence , which would mean that setting the field to or to (unset) have the same effect: However, the PodSecurityPolicy provider implementation handles the (unset) case differently, and thus does differentiate between unset or values: The API type documentation should be updated to clarify this behaviour and reflect the actual PodSecurityPolicy implementation. /sig node
Thanks for reporting this issue. I think that would be best able to assist with this. /sig auth /remove-sig node
The pod documentation is correct. If the field is not set or is false, the enforcement is not performed by the kubelet. However, podsecuritypolicy with a runasuser strategy of mustrunasnonroot will force a pod that has not specified a runAsNonRoot setting or a runAsUser uid to runAsNonRoot: true The documentation on the MustRunAsNonRoot strategy of podsecuritypolicy should clarify the mutation behavior of the PSP /remove-kind bug /kind documentation
Can I take this issue?
^ this is something that can be changed.
Here's a proposed change to the documentation in : Is this sufficient to solve this issue? If so, should I submit a PR there?
I'd change that to to be a little more complete.
/assign See PR for docs at
GitHub didn't allow me to assign the following users: josiahbjorgaard. Note that only and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign See PR for docs at Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
~This would have saved me some battling today! I couldn't work out why my pod wasn't selecting my run-as-root pod security policy and ignoring my restricted pod security policy - I didn't realise I had to explicitly set to get the correct PSP to match (I thought the restrictive PSP would reject the pod and then the run-as-root PSP would match, not that the restrictive PSP would mutate the PodSpec)~ It would have had I read the actual docs better sigh.

Discussion:
NetworkPluginName:         s.NetworkPluginName, NetworkPlugins:            ProbeNetworkPlugins(s.NetworkPluginDir), NodeStatusUpdateFrequency: s.NodeStatusUpdateFrequency, <ins> OOMAdjuster:               oom.NewOOMAdjuster(), </ins> OSInterface:               kubecontainer.RealOS{}, PodCIDR:                   s.PodCIDR, PodInfraContainerImage:    s.PodInfraContainerImage,

glog.V(2).Infof("Using root directory: %v", s.RootDirectory) // TODO(vmarmol): Do this through container config. <del> oomAdjuster := oom.NewOOMAdjuster() </del> <ins> oomAdjuster := kcfg.OOMAdjuster </ins> if err := oomAdjuster.ApplyOOMScoreAdj(0, s.OOMScoreAdj); err != nil { glog.Warning(err) }

MinimumGCAge:              minimumGCAge, Mounter:                   mount.New(), NodeStatusUpdateFrequency: nodeStatusUpdateFrequency, <ins> OOMAdjuster:               oom.NewFakeOOMAdjuster(), </ins> OSInterface:               osInterface, PodInfraContainerImage:    dockertools.PodInfraContainerImage, Port:              port,

NetworkPlugins                 []network.NetworkPlugin NodeName                       string NodeStatusUpdateFrequency      time.Duration <ins> OOMAdjuster                    *oom.OOMAdjuster </ins> OSInterface                    kubecontainer.OSInterface PodCIDR                        string PodInfraContainerImage         string

kc.DockerExecHandler, kc.ResolverConfig, kc.CPUCFSQuota, <del> daemonEndpoints) </del> <ins> daemonEndpoints, kc.OOMAdjuster) </ins> if err != nil { return nil, nil, err

&api.NodeDaemonEndpoints{ KubeletEndpoint: api.DaemonEndpoint{Port: int(kc.Port)}, }, <ins> kc.OOMAdjuster, </ins> ) if err != nil { return nil, nil, err

dockerExecHandler dockertools.ExecHandler, resolverConfig string, cpuCFSQuota bool, <del> daemonEndpoints *api.NodeDaemonEndpoints) (*Kubelet, error) { </del> <ins> daemonEndpoints *api.NodeDaemonEndpoints, oomAdjuster *oom.OOMAdjuster) (*Kubelet, error) { </ins> if rootDirectory == "" { return nil, fmt.Errorf("invalid root directory %q", rootDirectory) }

return nil, err } <del> oomAdjuster := oom.NewOOMAdjuster() </del> procFs := procfs.NewProcFs() // Initialize the runtime.

func NewFakeOOMAdjuster() *OOMAdjuster { return &OOMAdjuster{ <ins> pidLister:                 func(cgroupName string) ([]int, error) { return make([]int, 0), nil }, </ins> ApplyOOMScoreAdj:          fakeApplyOOMScoreAdj, ApplyOOMScoreAdjContainer: fakeApplyOOMScoreAdjContainer, }