<p>Good afternoon.</p>
<p>So I have an RKE2 cluster with the security policy in place that does not allow root pods to run. I have a pod that has to run as root and have been trying to figure out how to allow my pod to deploy on this cluster without success.</p>
<p>So far I have tried to explicitly set the following:</p>
<pre><code>securityContext:
  runAsUser: 0
  runAsGroup: 0
</code></pre>
<p>The pod still fails to be allowed to run on the environment. Is there a way to not totally disable the security policy and perhaps an an exception for a single namespace? Thank you.</p>

IT_User
To create a pod that has to run as root when cluster with the security policy in place that does not allow root pods to run you need to create a security policy for each namespace. Role Based Access Control (RBAC) allows you to create fine-grained roles and policies to manage access control for users and software running on your cluster, you can find more information in this <a href="https://docs.giantswarm.io/getting-started/rbac-and-psp/" rel="nofollow noreferrer">document</a>.<br /><br />PodSecurityPolicy is deprecated and will be completely removed in v1.25, you should start considering<a href="https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/" rel="nofollow noreferrer"> migrating to Pod Security Admission</a> where "kube-system" namespace is explicitly exempted from PodSecurity.<br /><br /><a href="https://kubernetes.io/docs/reference/access-authn-authz/psp-to-pod-security-standards/" rel="nofollow noreferrer"></a></p>
Known limitations: <a href="https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/2579-psp-replacement/README.md#namespace-policy-update-warnings" rel="nofollow noreferrer">Namespace policy update warnings</a></p>
<br /><br />Follow this <a href="https://capstonec.com/2020/04/22/hands-on-with-kubernetes-pod-security-policies/" rel="nofollow noreferrer">document</a> for more information</p>
