<p>I am trying to deploy a Pod in my <code>v1.13.6-gke.6</code> k8s cluster.</p>

<p>The image that I'm using is pretty simple:</p>

<pre><code>FROM scratch
LABEL maintainer "Bitnami &lt;containers@bitnami.com&gt;"

COPY rootfs /

USER 1001
CMD [ "/chart-repo" ]
</code></pre>

<p>As you can see, the user is set to <code>1001</code>.</p>

<p>The cluster that I am deploying the Pod in has a PSP setup.</p>

<pre><code>spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - IPC_LOCK
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  runAsUser:
    rule: MustRunAsNonRoot
</code></pre>

<p>So basically as per the <code>rule: MustRunAsNonRoot</code> rule, the above image should run.</p>

<p>But when I ran the image, I randomly run into :</p>

<pre><code>Error: container has runAsNonRoot and image will run as root
</code></pre>

<p>So digging further, I got this pattern:</p>

<p>Every time I run the image with <code>imagePullPolicy: IfNotPresent</code>, I always run into the issue. Meaning every time I picked up a cached image, it gives the <code>container has runAsNonRoot</code> error.</p>

<pre><code>  Normal   Pulled     12s (x3 over 14s)  kubelet, test-1905-default-pool-1b8e4761-fz8s  Container image "my-repo/bitnami/kubeapps-chart-repo:1.4.0-r1" already present on machine
  Warning  Failed     12s (x3 over 14s)  kubelet, test-1905-default-pool-1b8e4761-fz8s  Error: container has runAsNonRoot and image will run as root
</code></pre>

<p>BUT</p>

<p>Every time I run the image as <code>imagePullPolicy: Always</code>, the image SUCCESSFULLY runs:</p>

<pre><code>  Normal  Pulled     6s    kubelet, test-1905-default-pool-1b8e4761-sh5g  Successfully pulled image "my-repo/bitnami/kubeapps-chart-repo:1.4.0-r1"
  Normal  Created    5s    kubelet, test-1905-default-pool-1b8e4761-sh5g  Created container
  Normal  Started    5s    kubelet, test-1905-default-pool-1b8e4761-sh5g  Started container
</code></pre>

<p>So I'm not really sure what all this is about. I mean just because the <code>ImagePullPolicy</code> is different, why does it wrongly setup a PSP rule? </p>

Jason Stanley
<p>Found out the issue. Its a known issue with k8s for 2 specific versions <code>v1.13.6</code> &amp; <code>v1.14.2</code>.</p>

<p><a href="https://github.com/kubernetes/kubernetes/issues/78308" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/78308</a></p>
