title: Kubernetes isn't allowing me to create a pod with securityContext runAsUser
body: <p><strong>Summary:</strong></p>
  
  <p>I have pods with <code>security context: runAsUser: 1337</code> that fail to start due to being disallowed by policy. I have altered admission-control to no success (as suggested <a href="https://github.com/kubernetes/kubernetes/issues/45324#issuecomment-299134709" rel="nofollow noreferrer">here</a>
   and <a href="https://github.com/istio/istio/issues/324#issuecomment-304116794" rel="nofollow noreferrer">here</a>)</p>
  
  <p>What else do I need to force through this kind of security context?</p>
  
  <p><strong>Details</strong></p>
  
  <p>I'm working through the <a href="https://istio.io/docs/samples/bookinfo.html" rel="nofollow noreferrer">https://istio.io/docs/samples/bookinfo.html</a> example to start porting over to istio.</p>
  
  <p>I have a deployment named <code>details-v1</code> (see below) from which a replica set and pod have been created. The pod is stuck in pending.</p>
  
  <pre><code>NAME                                      READY     STATUS    RESTARTS   AGE
  details-v1-3207759430-nt9tt               0/2       Pending   0          34m
  </code></pre>
  
  <p><code>describe</code> on the pod shows the cause of the error:</p>
  
  <pre><code>FailedValidation    Error validating pod details-v1-3207759430-nt9tt.azs-master from api, ignoring: spec.initContainers[1].securityContext.privileged: Forbidden: disallowed by policy
  </code></pre>
  
  <p>In order to get this far, I have already made changes to the kube-apiserver:</p>
  
  <pre><code>/usr/local/bin/kube-apiserver \
    --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota \
    --allow-privileged=true \
  </code></pre>
  
  <p>Deployment:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    annotations:
      deployment.kubernetes.io/revision: "1"
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"extensions/v1beta1","kind":"Deployment","metadata":{"annotations":{},"creationTimestamp":null,"name":"details-v1","namespace":"azs-master"},"spec":{"replicas":1,"strategy":{},"template":{"metadata":{"annotations":{"alpha.istio.io/sidecar":"injected","alpha.istio.io/version":"jenkins@ubuntu-16-04-build-12ac793f80be71-0.1.6-dab2033","pod.beta.kubernetes.io/init-containers":"[{\"args\":[\"-p\",\"15001\",\"-u\",\"1337\"],\"image\":\"docker.io/istio/init:0.1\",\"imagePullPolicy\":\"Always\",\"name\":\"init\",\"securityContext\":{\"capabilities\":{\"add\":[\"NET_ADMIN\"]}}},{\"args\":[\"-c\",\"sysctl -w kernel.core_pattern=/tmp/core.%e.%p.%t \\u0026\\u0026 ulimit -c unlimited\"],\"command\":[\"/bin/sh\"],\"image\":\"alpine\",\"imagePullPolicy\":\"Always\",\"name\":\"enable-core-dump\",\"securityContext\":{\"privileged\":true}}]"},"creationTimestamp":null,"labels":{"app":"details","version":"v1"}},"spec":{"containers":[{"image":"istio/examples-bookinfo-details-v1","imagePullPolicy":"IfNotPresent","name":"details","ports":[{"containerPort":9080}],"resources":{}},{"args":["proxy","sidecar","-v","2"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}},{"name":"POD_IP","valueFrom":{"fieldRef":{"fieldPath":"status.podIP"}}}],"image":"docker.io/istio/proxy_debug:0.1","imagePullPolicy":"Always","name":"proxy","resources":{},"securityContext":{"runAsUser":1337},"volumeMounts":[{"mountPath":"/etc/certs","name":"istio-certs","readOnly":true}]}],"volumes":[{"name":"istio-certs","secret":{"secretName":"istio.default"}}]}}},"status":{}}
    creationTimestamp: 2017-06-23T13:30:00Z
    generation: 1
    labels:
      app: details
      version: v1
    name: details-v1
    namespace: azs-master
    resourceVersion: "29678612"
    selfLink: /apis/extensions/v1beta1/namespaces/azs-master/deployments/details-v1
    uid: 0eacea4a-5818-11e7-af0e-0a55ca98bb17
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: details
        version: v1
    strategy:
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 1
      type: RollingUpdate
    template:
      metadata:
        annotations:
          alpha.istio.io/sidecar: injected
          alpha.istio.io/version: jenkins@ubuntu-16-04-build-12ac793f80be71-0.1.6-dab2033
          pod.alpha.kubernetes.io/init-containers: '[{"name":"init","image":"docker.io/istio/init:0.1","args":["-p","15001","-u","1337"],"resources":{},"imagePullPolicy":"Always","securityContext":{"capabilities":{"add":["NET_ADMIN"]}}},{"name":"enable-core-dump","image":"alpine","command":["/bin/sh"],"args":["-c","sysctl
            -w kernel.core_pattern=/tmp/core.%e.%p.%t \u0026\u0026 ulimit -c unlimited"],"resources":{},"imagePullPolicy":"Always","securityContext":{"privileged":true}}]'
          pod.beta.kubernetes.io/init-containers: '[{"name":"init","image":"docker.io/istio/init:0.1","args":["-p","15001","-u","1337"],"resources":{},"imagePullPolicy":"Always","securityContext":{"capabilities":{"add":["NET_ADMIN"]}}},{"name":"enable-core-dump","image":"alpine","command":["/bin/sh"],"args":["-c","sysctl
            -w kernel.core_pattern=/tmp/core.%e.%p.%t \u0026\u0026 ulimit -c unlimited"],"resources":{},"imagePullPolicy":"Always","securityContext":{"privileged":true}}]'
        creationTimestamp: null
        labels:
          app: details
          version: v1
      spec:
        containers:
        - image: istio/examples-bookinfo-details-v1
          imagePullPolicy: IfNotPresent
          name: details
          ports:
          - containerPort: 9080
            protocol: TCP
          resources: {}
          terminationMessagePath: /dev/termination-log
        - args:
          - proxy
          - sidecar
          - -v
          - "2"
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: POD_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          image: docker.io/istio/proxy_debug:0.1
          imagePullPolicy: Always
          name: proxy
          resources: {}
          securityContext:
            runAsUser: 1337
          terminationMessagePath: /dev/termination-log
          volumeMounts:
          - mountPath: /etc/certs
            name: istio-certs
            readOnly: true
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - name: istio-certs
          secret:
            defaultMode: 420
            secretName: istio.default
  status:
    conditions:
    - lastTransitionTime: 2017-06-23T13:30:00Z
      lastUpdateTime: 2017-06-23T13:30:00Z
      message: Deployment has minimum availability.
      reason: MinimumReplicasAvailable
      status: "True"
      type: Available
    observedGeneration: 1
    replicas: 1
    unavailableReplicas: 1
    updatedReplicas: 1
  </code></pre>
  
  <p>Kubernetes server version: 1.5.6</p>