We have been running Kubernetes 1.13 for quite a while in onprem clusters. We're now upgrading them to 1.24.
There is one service that attempted to deploy on the new cluster that is failing with the following event in the deployment object:
message: 'pods "..." is forbidden: violates
PodSecurity "baseline:latest": hostPath volumes (volume "...")'
I've found several issues and threads that discuss this, but they all bypass the background of this issue and attempt to provide a solution, which is apparently adding the following label to the deployment: "pod-security.kubernetes.io/enforce: privileged".
Actually, I'm not certain whether adding it to the deployment will help. In fact, I've tried adding it both the labels of the deployment and the labels of the template in the deployment, and that made no difference. Is this needed in the namespace object instead?
Even if I can figure out where to add this so it actually works, I'm not satisfied with simply adding this without understanding exactly what is going on here. I believe this is essentially decreasing security, although if there's no alternative if we really need to map a volume to a directory on the host, and now this isn't allowed by default, then that's what we'll have to do, but I need to confirm that.
I also note that when we deploy services to these new clusters, we get some additional security warnings that we haven't seen before, one of which is the following:
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers ... must set securityContext.allowPrivilegeEscalation=false)
My intention is to resolve all four of these warnings by following the instructions in the warning, which for this one will be setting "allowPrivilegeEscalation=false". Do these two settings have any relation to each other (besides having the obvious "privilege" in both)?
