K3s is a lightweight Kubernetes distribution designed for resource-constrained environments and edge computing. It simplifies the deployment and management of Kubernetes clusters by reducing the overhead and complexity typically associated with Kubernetes. K3s is particularly well-suited for IoT devices, edge computing, and CI/CD pipelines.
When working with K3s, you might encounter an error where a pod fails to be scheduled due to a PodSecurityPolicyViolation. This issue typically manifests as a pod stuck in a Pending state, with events indicating a security policy violation.
The error message might look like this:
Error: pod didn't trigger scale-up (it wouldn't fit if a new node is added): 1 node(s) didn't match PodSecurityPolicy
A PodSecurityPolicy (PSP) is a cluster-level resource in Kubernetes that controls security-sensitive aspects of the pod specification. It defines a set of conditions that a pod must meet to be accepted into the system. If a pod's configuration does not comply with the PSP, it will not be scheduled.
The root cause of a PodSecurityPolicyViolation is typically a mismatch between the pod's security requirements and the constraints defined by the PSP. This could be due to:
To resolve this issue, you need to adjust either the pod specification or the PodSecurityPolicy. Here are the steps to follow:
First, review the existing PodSecurityPolicy to understand the constraints. You can list all PSPs using the following command:
kubectl get psp
To view the details of a specific PSP, use:
kubectl describe psp <psp-name>
Check the pod's security context and ensure it aligns with the PSP requirements. For example, if the PSP requires a specific runAsUser, ensure your pod's security context matches:
apiVersion: v1
kind: Pod
metadata:
name: example-pod
spec:
securityContext:
runAsUser: 1000
If the pod's requirements are valid and necessary, consider modifying the PSP to accommodate them. Edit the PSP using:
kubectl edit psp <psp-name>
Ensure that the PSP allows the necessary security contexts, capabilities, and other settings required by your pod.
For more information on PodSecurityPolicies, refer to the official Kubernetes documentation on Pod Security Policies.
To learn more about managing security contexts in Kubernetes, visit the Security Contexts page.
(Perfect for DevOps & SREs)
(Perfect for DevOps & SREs)
