Change:
when deploying a container that has runAsNonRoot but runs as root this error appears, but for pods with lots of containers it can be confusing which container failed, especially if there are 3-rd party webhooks that inject containers please add the container name to the message, making it
/sig api-machinery
/assign I can try this fix
I just submitted a pr, can you review it for me, is it as you expected?
thx, looks good!
/remove-sig api-machiner /sig node /area kubelet
Those labels are not set on the issue: <detailsIn response to : /remove-sig api-machiner /sig node /area kubelet Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/remove-sig api-machinery

Discussion:
"fmt" "k8s.io/api/core/v1" <ins> "k8s.io/kubernetes/pkg/kubelet/util/format" </ins> "k8s.io/kubernetes/pkg/securitycontext" )

if effectiveSc.RunAsUser != nil { if *effectiveSc.RunAsUser == 0 { <del> return fmt.Errorf("container's runAsUser breaks non-root policy") </del> <ins> return fmt.Errorf("container's runAsUser breaks non-root policy (pod: %q, container: %s)", format.Pod(pod), container.Name) </ins> } return nil } switch { case uid != nil && *uid == 0: <del> return fmt.Errorf("container has runAsNonRoot and image will run as root") </del> <ins> return fmt.Errorf("container has runAsNonRoot and image will run as root (pod: %q, container: %s)", format.Pod(pod), container.Name) </ins> case uid == nil && len(username) > 0: <del> return fmt.Errorf("container has runAsNonRoot and image has non-numeric user (%s), cannot verify user is non-root", username) </del> <ins> return fmt.Errorf("container has runAsNonRoot and image has non-numeric user (%s), cannot verify user is non-root (pod: %q, container: %s)", username, format.Pod(pod), container.Name) </ins> default: return nil }

"fmt" "k8s.io/api/core/v1" "k8s.io/klog/v2" <ins> "k8s.io/kubernetes/pkg/kubelet/util/format" </ins> "k8s.io/kubernetes/pkg/securitycontext" )

return nil } if effectiveSc.RunAsUser != nil { <del> klog.Warningf("Windows container does not support SecurityContext.RunAsUser, please use SecurityContext.WindowsOptions") </del> <ins> klog.Warningf("Windows container does not support SecurityContext.RunAsUser, please use SecurityContext.WindowsOptions (pod: %q, container: %s)", format.Pod(pod), container.Name) </ins> } if effectiveSc.SELinuxOptions != nil { <del> klog.Warningf("Windows container does not support SecurityContext.SELinuxOptions, please use SecurityContext.WindowsOptions") </del> <ins> klog.Warningf("Windows container does not support SecurityContext.SELinuxOptions, please use SecurityContext.WindowsOptions (pod: %q, container: %s)", format.Pod(pod), container.Name) </ins> } if effectiveSc.RunAsGroup != nil { <del> klog.Warningf("Windows container does not support SecurityContext.RunAsGroup") </del> <ins> klog.Warningf("Windows container does not support SecurityContext.RunAsGroup (pod: %q, container: %s)", format.Pod(pod), container.Name) </ins> } if effectiveSc.WindowsOptions != nil { if effectiveSc.WindowsOptions.RunAsUserName != nil { if *effectiveSc.WindowsOptions.RunAsUserName == windowsRootUserName { <del> return fmt.Errorf("container's runAsUser (%s) which will be regarded as root identity and will break non-root policy", username) </del> <ins> return fmt.Errorf("container's runAsUser (%s) which will be regarded as root identity and will break non-root policy (pod: %q, container: %s)", username, format.Pod(pod), container.Name) </ins> } return nil } } if len(username) > 0 && username == windowsRootUserName { <del> return fmt.Errorf("container's runAsUser (%s) which will be regarded as root identity and will break non-root policy", username) </del> <ins> return fmt.Errorf("container's runAsUser (%s) which will be regarded as root identity and will break non-root policy (pod: %q, container: %s)", username, format.Pod(pod), container.Name) </ins> } return nil }