You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Switch the default value of secure-pod-defaults to be more secure #16137
We've introduced an intermediate setting that is secure and allows root images. We didn't switch this to the default in 1.20 but will do this for 1.21 in order to give people enough notice.
I wonder if this simplifies root-allowed to be the exact same as enabled - given the container can think it's root but it's not actually root on the host.
I wonder if this simplifies root-allowed to be the exact same as enabled - given the container can think it's root but it's not actually root on the host.
I think it's worth asking whether the pod security standards should be updated for 1.33 or later -- the goal of this feature was to allow containers to run in the restricted profile without application developer changes. Unfortunately, the restricted profile doesn't say anything about hostUsers: false at the moment, so that setting doesn't meet the "containers just work when my namespace is annotated" feature.
Unfortunately, the restricted profile doesn't say anything about hostUsers: false at the moment, so that setting doesn't meet the "containers just work when my namespace is annotated" feature.
Yeah, another good point. It seems like the restricted profile should be updated.
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.
Activity
dprotaso commentedon Oct 21, 2025
cc @nader-ziada @evankanderson
With the 1.21 release we are moving to K8s 1.33 as the min version.
In K8s 1.33 I saw that uid mappings are an available now: https://www.cncf.io/blog/2025/07/16/securing-kubernetes-1-33-pods-the-impact-of-user-namespace-isolation/
I wonder if this simplifies
root-allowedto be the exact same asenabled- given the container can think it's root but it's not actually root on the host.evankanderson commentedon Oct 21, 2025
I think it's worth asking whether the pod security standards should be updated for 1.33 or later -- the goal of this feature was to allow containers to run in the
restrictedprofile without application developer changes. Unfortunately, therestrictedprofile doesn't say anything abouthostUsers: falseat the moment, so that setting doesn't meet the "containers just work when my namespace is annotated" feature.dprotaso commentedon Oct 22, 2025
Good point. Asked here: https://kubernetes.slack.com/archives/C0BP8PW9G/p1761095246021789?thread_ts=1761079761.151219&cid=C0BP8PW9G
Yeah, another good point. It seems like the restricted profile should be updated.
github-actions commentedon Jan 20, 2026
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with
/reopen. Mark the issue asfresh by adding the comment
/remove-lifecycle stale.linkvt commentedon Jan 20, 2026
/lifecycle frozen