unable to deploy privileged pod after 1.8 upgrade unless I set allowPrivilegeEscalation true

[jhorwit2]

Is this a BUG REPORT or FEATURE REQUEST?:

/kind bug

What happened:

I upgraded a cluster to 1.8 and ran into an issue with pods that use privileged: true and don't set allowPrivilegeEscalation: true.

The PSP I had created and been using prior to 1.8:

apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
  name: privileged
spec:
  privileged: true
  hostNetwork: true
  hostPID: true
  hostIPC: true
  hostPorts:
  - min: 1
    max: 32000
  fsGroup:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'

The error I got when applying an update to the canal daemonset:

  Warning  FailedCreate  10m                 daemon-set  Error creating: Pod "canal-z8dmj" is invalid: [spec.containers[0].securityContext: Invalid value: api.SecurityContext{Capabilities:(*api.Capabilities)(nil), Privileged:(*bool)(0xc424f9c2c0), SELinuxOptions:(*api.SELinuxOptions)(nil), RunAsUser:(*int64)(nil), RunAsNonRoot:(*bool)(nil), ReadOnlyRootFilesystem:(*bool)(nil), AllowPrivilegeEscalation:(*bool)(0xc427e10c38)}: cannot set `allowPrivilegeEscalation` to false and `privileged` to true, spec.containers[2].securityContext: Invalid value: api.SecurityContext{Capabilities:(*api.Capabilities)(nil), Privileged:(*bool)(0xc424f9c2ca), SELinuxOptions:(*api.SELinuxOptions)(nil), RunAsUser:(*int64)(nil), RunAsNonRoot:(*bool)(nil), ReadOnlyRootFilesystem:(*bool)(nil), AllowPrivilegeEscalation:(*bool)(0xc427e10c38)}: cannot set `allowPrivilegeEscalation` to false and `privileged` to true]

What you expected to happen:

I expect the pod to be valid since it was not noted as a breaking change in the release notes for 1.8.

How to reproduce it (as minimally and precisely as possible):

Using the PSP above, attempt to create a pod with privileged: true and no value for allowPrivilegeEscalation.

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.0", GitCommit:"6e937839ac04a38cac63e6a7a306c5d035fe7b0a", GitTreeState:"clean", BuildDate:"2017-09-28T22:57:57Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.0", GitCommit:"6e937839ac04a38cac63e6a7a306c5d035fe7b0a", GitTreeState:"clean", BuildDate:"2017-09-28T22:46:41Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

cc @liggitt @tallclair @jessfraz

[k8s-github-robot]

@jhorwit2
There are no sig labels on this issue. Please add a sig label by:

1. mentioning a sig: @kubernetes/sig-<group-name>-<group-suffix>
   e.g., @kubernetes/sig-contributor-experience-<group-suffix> to notify the contributor experience sig, OR

2. specifying the label manually: /sig <label>
   e.g., /sig scalability to apply the sig/scalability label

Note: Method 1 will trigger an email to the group. You can find the group list here and label list here.
The <group-suffix> in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals

[jhorwit2]

/sig auth

[jhorwit2]

semi-unrelated: the error message on that event is hideous 👼

[liggitt]

@jessfraz @tallclair existing PSPs should continue to work as they did prior to the introduction of this field. doesn't that mean DefaultAllowPrivilegeEscalation has to default to true in PSPs if unspecified?

[liggitt]

alternatively, psp.Spec.AllowPrivilegeEscalation could have been a *bool, defaulting to nil/no-opinion

edit: thinking through this more, I think we have to make AllowPrivilegeEscalation a *bool, omitempty... 1.8.0 clients/servers do the wrong thing, dropping an explicit allowPrivilegeEscalation: false and treating it the same as a legacy PSP object that should have defaulted to allowing privilege escalation for backward compatibility

[k8s-github-robot]

[MILESTONENOTIFIER] Milestone Labels Complete

@jessfraz @jhorwit2 @liggitt @tallclair

Issue label settings:

• sig/auth: Issue will be escalated to these SIGs if needed.
• priority/critical-urgent: Never automatically move out of a release milestone; continually escalate to contributor and SIG through all available channels.
• kind/bug: Fixes a bug discovered during the current release.

Additional instructions available here The commands available for adding these labels are documented here

[liggitt]

fixed in 1.8.1