<p>I have build a docker image containing <code>tshark</code> (its an image I am going to use for doing various manual debugging from a kubernetes pod).</p>

<p>I have deployed a container in kubernetes running that image. But when I access the container and try to run <code>tshark</code> I get:</p>

<pre><code>$ kubectl exec myapp-cbd49f587-w2swx -it bash
root@myapp-cbd49f587-w2swx:/# tshark -ni any -f "test.host" -w sample.pcap -F libpcap
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
tshark: cap_set_proc() fail return: Operation not permitted
</code></pre>

<p>Googling that error:</p>

<p><a href="https://www.weave.works/blog/container-capabilities-kubernetes/" rel="noreferrer">https://www.weave.works/blog/container-capabilities-kubernetes/</a>
<a href="https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/policy/container-capabilities/" rel="noreferrer">https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/policy/container-capabilities/</a></p>

<p>it seems I need to configure a <code>securityContext</code> for my container/pod. In my deployment.yaml I have added:</p>

<pre><code>  containers:
     ...
  securityContext:
    capabilities:
      add:
        - NET_ADMIN
</code></pre>

<p>But when I apply that deployment I get:</p>

<pre><code>error: error validating "deployment.yaml": error validating data: ValidationError(Deployment.spec.template.spec.securityContext): unknown field "capabilities" in io.k8s.api.core.v1.PodSecurityContext; if you choose to ignore these errors, turn validation off with --validate=false
</code></pre>

<p>Adding <code>--validate=false</code> removes the error but also means the securityContext is ignored.</p>

<p>What is preventing me from setting:</p>

<pre><code>  securityContext:
    capabilities:
      add:
        - NET_ADMIN
</code></pre>

<p>Based on the guides I have found this should be fine.</p>

<p>I have also looked at (looks to be non free):</p>

<p><a href="https://sysdig.com/blog/tracing-in-kubernetes-kubectl-capture-plugin/" rel="noreferrer">https://sysdig.com/blog/tracing-in-kubernetes-kubectl-capture-plugin/</a></p>

<p>so probably the right way is to use some tool like that (<a href="https://github.com/eldadru/ksniff" rel="noreferrer">ksniff</a>) or setup a  <a href="https://developers.redhat.com/blog/2019/02/27/sidecars-analyze-debug-network-traffic-kubernetes-pod/" rel="noreferrer">sidecar container</a>. But I am still curious to why I get the above error.</p>

<p>Looking specifically to the error, you posted only part of your manifest and looking to this we can see that you put <code>securityContext:</code> in the same level as <code>containers:</code>:</p>
<pre><code>  containers:
     ...
  securityContext:
    capabilities:
      add:
        - NET_ADMIN
</code></pre>
<p>It should be under <code>containers:</code> as as written in the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="noreferrer">documentation</a>:</p>
<blockquote>
<p>To add or remove Linux capabilities for a Container, include the
<code>capabilities</code> field in the <code>securityContext</code> section of the Container
manifest.</p>
</blockquote>
<p>Example:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: security-context-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: security-context-demo
  template:
    metadata:
      labels:
        app: security-context-demo
    spec:
      containers:
      - name: sec-ctx-4
        image: gcr.io/google-samples/node-hello:1.0
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
</code></pre>
