K8s Restricted Policy Root User Violation

The Incident (What does the error mean?)

Raw admission webhook rejection:

Error from server (Forbidden): error when creating "deployment.yaml":
pods "api-server-6d4f8b9c7-x2k9p" is forbidden:
violation policy check failed for pod: [{"message":"violation: pod must not set runAsUser to 0","reason":"Forbidden"}]

Starting with Kubernetes 1.25, PSA replaced PodSecurityPolicy (PSP). In 1.29, many clusters that migrated from PSP with enforce: baseline are now being tightened to enforce: restricted — and the restricted profile is unambiguous: root UID is forbidden, full stop. The admission controller fires synchronously at kubectl apply time. The pod object is never written to etcd. Your Deployment, StatefulSet, or Job sits at 0/N replicas with no further error surface unless you check events.

Check events immediately:

kubectl get events -n <namespace> --field-selector reason=FailedCreate --sort-by='.lastTimestamp'

The Attack Vector / Blast Radius

This is not a theoretical risk. A container running as UID 0 inside a pod means:

• Container escape = full node compromise. If any CVE allows a container breakout (runc, containerd, kernel vuln), the attacker lands on the node as root. No privilege escalation step required.
• Shared PID namespace abuse. Root containers can ptrace or kill processes in other containers on the same node if hostPID: true is ever set, or signal processes via /proc.
• Volume mount privilege abuse. Root can read/write hostPath mounts, emptyDir volumes shared with sidecar containers, and potentially access service account tokens of other pods via filesystem traversal.
• Blast radius in multi-tenant clusters: One compromised root container in a namespace can pivot to kube-system via node-level access, exfiltrate all secrets stored in etcd if the node has kubelet credentials, and laterally move to cloud provider metadata APIs (IMDS) to steal IAM credentials.

The PSA restricted policy is the correct defense-in-depth layer. The violation being surfaced now is the policy working as designed — your image or chart was always misconfigured.

Prevention in CI/CD

The only acceptable answer is shift-left. This violation must never reach a running cluster.

1. Checkov (fastest to add)

# In your GitHub Actions / GitLab CI pipeline
pip install checkov
checkov -f deployment.yaml --check CKV_K8S_6,CKV_K8S_8,CKV_K8S_9,CKV_K8S_28,CKV_K8S_30

Key checks: CKV_K8S_6 = do not admit root containers, CKV_K8S_28 = non-root must be enforced, CKV_K8S_30 = seccomp profile required.

2. Kyverno ClusterPolicy (in-cluster prevention)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-run-as-non-root
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-runAsNonRoot
      match:
        resources:
          kinds: [Pod]
      validate:
        message: "Containers must not run as root. Set runAsNonRoot: true and runAsUser >= 1000."
        pattern:
          spec:
            containers:
              - securityContext:
                  runAsNonRoot: true
                  runAsUser: ">=1000"

3. Helm chart linting with `helm lint` + `kubeconform`

If you're shipping Helm charts, add kubeconform with the PSS restricted schema to your chart CI:

helm template my-release ./chart | kubeconform -strict -kubernetes-version 1.29.0

4. Dockerfile enforcement

# Every application Dockerfile must end with this
RUN addgroup --system --gid 1001 appgroup && \
    adduser --system --uid 1001 --ingroup appgroup appuser
USER 1001

Enforce this in your base image pipeline. If USER is not set or is set to 0 or root, fail the image build in CI using a hadolint rule:

hadolint --error DL3002 Dockerfile
# DL3002: Last USER should not be root

Bottom line: The restricted PSA profile is non-negotiable in any cluster handling real workloads. Every image in your registry should be buildable and runnable as UID ≥ 1000. Audit your base images now — node:lts, python:3.12, and many vendor images still default to root. Pin to -slim or -nonroot variants, or build your own hardened base.