Help: require-run-as-non-root policy doesn't work

[tamekitten]

Hello.
After doing the described steps to verify policies on Kyverno 1.5.4:

1. Install Kyverno (if needed):
   kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/main/definitions/release/install.yaml
2. Install policies:
   kustomize build https://github.com/kyverno/policies/pod-security | kubectl apply -f -
3. Apply test YAMLs
   kustomize build https://github.com/kyverno/policies/pod-security/tests | kubectl apply -f -

I have some pods created but there should be no one according to the instruction.

root@tst-adm:~# kubectl get pods
NAME             READY   STATUS                       RESTARTS   AGE
nonroot-pod      1/1     Running                      0          13s
proc-mount       0/1     CreateContainerConfigError   0          13s
root-init-ctnr   0/1     Init:0/1                     0          13s
root-pod         1/1     Running                      0          13s

3 of them are from test of require-run-as-non-root policy:

root@tst-adm:~# kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/pod-security/tests/restricted/test-require-run-as-nonroot.yaml
pod/nonroot-pod created
pod/root-pod created
pod/root-init-ctnr created

Can you give any clue why this policy could not work and what should I do to make it work as expected?

I can find these lines in logs:

I0116 19:58:40.750623       1 policy_controller.go:200] PolicyController "msg"="policy created"  "kind"="ClusterPolicy" "name"="require-run-as-non-root" "uid"="dfb7c86f-d900-4dd0-b8ce-221e8251f172"
I0116 19:59:03.500569       1 configmanager.go:399] WebhookConfigManager/reconcileWebhook "msg"="policy is ready to serve admission requests" "namespace"="" "policy"="require-run-as-non-root"
I0116 20:00:26.700326       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/nonroot-pod" "policy"="require-run-as-non-root"
I0116 20:00:26.723811       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/nonroot-pod" "policy"="require-run-as-non-root"
I0116 20:00:26.755109       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/root-pod" "policy"="require-run-as-non-root"
I0116 20:00:26.780454       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/root-pod" "policy"="require-run-as-non-root"
I0116 20:00:26.815199       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/root-init-ctnr" "policy"="require-run-as-non-root"
I0116 20:00:26.842419       1 validation.go:83] WebhookServer "msg"="validation passed" "action"="validate" "gvk"="/v1, Kind=Pod" "operation"="CREATE" "resource"="default/Pod/root-init-ctnr" "policy"="require-run-as-non-root"

[chipzoller]

All (for the most part) sample policies are set to audit mode which means they will not block violating resources but report on them with a Policy Report object. We note this atop the policies filter page here. If you wish for violating resources to be immediately blocked, set them to enforce mode.

[chipzoller]

Ok, anyPattern is somehow broken in the current 1.6 branch (which is a WIP anyhow). If you try this in a current release like Kyverno 1.5.4, it works as intended.

$ k apply -f temp.yaml 
Error from server: error when creating "temp.yaml": admission webhook "validate.kyverno.svc-fail" denied the request: 

resource Pod/default/root-pod was blocked due to the following policies

require-run-as-non-root:
  run-as-non-root: 'validation error: Running as root is not allowed. Either the field
    spec.securityContext.runAsNonRoot must be set to `true`, or the fields spec.containers[*].securityContext.runAsNonRoot,
    spec.initContainers[*].securityContext.runAsNonRoot, and spec.ephemeralContainers[*].securityContext.runAsNonRoot
    must be set to `true`. Rule run-as-non-root[0] failed at path /spec/securityContext/runAsNonRoot/.
    Rule run-as-non-root[1] failed at path /spec/containers/0/securityContext/.'

[realshuting]

@chipzoller - Do we have an issue tracking for the fix?

[chipzoller]

Yes: kyverno/kyverno#3004

[realshuting]

Thanks Chip!

[tamekitten]

But I have Kyverno of version 1.5.4 ...
Oh, I've downgraded Kuber cluster to 1.21.8 (from 1.23.1) and it's working! 1.22.5 is ok too.
Sorry, I haven't checked the compatibility matrix first.
Please notice that it's not working on Kubernetes version 1.23.1 =)