From b2c496aec3ff6c25788120c8812600ad8a0459e3 Mon Sep 17 00:00:00 2001 From: Josiah Bjorgaard Date: Tue, 18 Jun 2019 16:18:35 -0600 Subject: [PATCH] Clarify mutation behavior with MustRunAsNonRoot (#14820) --- content/en/docs/concepts/policy/pod-security-policy.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 08805d5011..8890f4d7a5 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -485,8 +485,10 @@ spec: minimum value of the first range as the default. Validates against all ranges. - *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero `runAsUser` or have the `USER` directive defined (using a numeric UID) in the -image. No default provided. Setting `allowPrivilegeEscalation=false` is strongly -recommended with this strategy. +image. Pods which have specified neither `runAsNonRoot` nor `runAsUser` settings +will be mutated to set `runAsNonRoot=true`, thus requiring a defined non-zero +numeric `USER` directive in the container. No default provided. Setting +`allowPrivilegeEscalation=false` is strongly recommended with this strategy. - *RunAsAny* - No default provided. Allows any `runAsUser` to be specified. **RunAsGroup** - Controls which primary group ID the containers are run with.