Change:
What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): kubelet securitycontext Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT <!-- If this is a BUG REPORT, please: Fill in as much of the template below as you can. If you leave out information, we can't help you as well. If this is a FEATURE REQUEST, please: Describe in detail the feature/behavior/change you'd like to see. In both cases, be ready for followup questions, and please respond in a timely manner. If we can't reproduce a bug or think a feature already exists, we might close your issue. If we're wrong, PLEASE feel free to reopen it and explain why. --Kubernetes version (use ): 1.7.0-beta/1.8.0 (HEAD) Environment: Cloud provider or hardware configuration: gce OS (e.g. from /etc/os-release): gci Kernel (e.g. ): Install tools: Others: docker runtime (rkt seems to have a different code path, but I haven't checked it) What happened: containers could not run as root when "RunAsNonRoot=false" What you expected to happen: containers could run as root How to reproduce it (as minimally and precisely as possible): add a securitycontext to a container, don't set privileged, do set RunAsNonRoot, use an image that runs as root. The PodSecurityPolicy admission controller will always set a securitycontext if it's not specified, and cause this to be hit more often. Anything else we need to know: The bug is in the checks here: I have a fix in but that going in depends on an extension being granted. We may want to fix the bug regardless.
/sig node
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
I'll send a fix shortly.

Discussion:
assert.Equal(t, expectedConfig, containerConfig, "generate container config for kubelet runtime v1.") runAsUser := types.UnixUserID(0) <del> RunAsNonRoot := false </del> <ins> runAsNonRootTrue := true </ins> podWithContainerSecurityContext := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ UID:       "12345678",

Command:         []string{"testCommand"}, WorkingDir:      "testWorkingDir", SecurityContext: &v1.SecurityContext{ <del> RunAsNonRoot: &RunAsNonRoot, </del> <ins> RunAsNonRoot: &runAsNonRootTrue, </ins> RunAsUser:    &runAsUser, }, },

// verifyRunAsNonRoot verifies RunAsNonRoot. func verifyRunAsNonRoot(pod *v1.Pod, container *v1.Container, uid int64) error { effectiveSc := securitycontext.DetermineEffectiveSecurityContext(pod, container) <del> if effectiveSc == nil || effectiveSc.RunAsNonRoot == nil { </del> <ins> // If the option is not set, or if running as root is allowed, return nil. if effectiveSc == nil || effectiveSc.RunAsNonRoot == nil || !*effectiveSc.RunAsNonRoot { </ins> return nil }

}, } <del> err := verifyRunAsNonRoot(pod, &pod.Spec.Containers[0], int64(0)) assert.NoError(t, err) runAsUser := types.UnixUserID(0) RunAsNonRoot := false podWithContainerSecurityContext := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ UID:       "12345678", Name:      "bar", Namespace: "new", </del> <ins> rootUser := types.UnixUserID(0) runAsNonRootTrue := true runAsNonRootFalse := false imageRootUser := int64(0) imageNonRootUser := int64(123) for _, test := range []struct { desc      string sc        *v1.SecurityContext imageUser int64 fail      bool }{ { desc:      "Pass if SecurityContext is not set", sc:        nil, imageUser: imageRootUser, fail:      false, </ins> }, <del> Spec: v1.PodSpec{ Containers: []v1.Container{ { Name:            "foo", Image:           "busybox", ImagePullPolicy: v1.PullIfNotPresent, Command:         []string{"testCommand"}, WorkingDir:      "testWorkingDir", SecurityContext: &v1.SecurityContext{ RunAsNonRoot: &RunAsNonRoot, RunAsUser:    &runAsUser, }, }, </del> <ins> { desc: "Pass if RunAsNonRoot is not set", sc: &v1.SecurityContext{ RunAsUser: &rootUser, </ins> }, <ins> imageUser: imageRootUser, fail:      false, </ins> }, <del> } err2 := verifyRunAsNonRoot(podWithContainerSecurityContext, &podWithContainerSecurityContext.Spec.Containers[0], int64(0)) assert.EqualError(t, err2, "container's runAsUser breaks non-root policy") RunAsNonRoot = false podWithContainerSecurityContext = &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ UID:       "12345678", Name:      "bar", Namespace: "new", </del> <ins> { desc: "Pass if RunAsNonRoot is false (image user is root)", sc: &v1.SecurityContext{ RunAsNonRoot: &runAsNonRootFalse, }, imageUser: imageRootUser, fail:      false, </ins> }, <del> Spec: v1.PodSpec{ Containers: []v1.Container{ { Name:            "foo", Image:           "busybox", ImagePullPolicy: v1.PullIfNotPresent, Command:         []string{"testCommand"}, WorkingDir:      "testWorkingDir", SecurityContext: &v1.SecurityContext{ RunAsNonRoot: &RunAsNonRoot, }, }, </del> <ins> { desc: "Pass if RunAsNonRoot is false (RunAsUser is root)", sc: &v1.SecurityContext{ RunAsNonRoot: &runAsNonRootFalse, RunAsUser:    &rootUser, </ins> }, <ins> imageUser: imageNonRootUser, fail:      false, </ins> }, <ins> { desc: "Fail if container's RunAsUser is root and RunAsNonRoot is true", sc: &v1.SecurityContext{ RunAsNonRoot: &runAsNonRootTrue, RunAsUser:    &rootUser, }, imageUser: imageNonRootUser, fail:      true, }, { desc: "Fail if image's user is root and RunAsNonRoot is true", sc: &v1.SecurityContext{ RunAsNonRoot: &runAsNonRootTrue, }, imageUser: imageRootUser, fail:      true, }, } { pod.Spec.Containers[0].SecurityContext = test.sc err := verifyRunAsNonRoot(pod, &pod.Spec.Containers[0], int64(0)) if test.fail { assert.Error(t, err, test.desc) } else { assert.NoError(t, err, test.desc) } </ins> } <del> err3 := verifyRunAsNonRoot(podWithContainerSecurityContext, &podWithContainerSecurityContext.Spec.Containers[0], int64(0)) assert.EqualError(t, err3, "container has runAsNonRoot and image will run as root") </del> }