kubernetes - kubelet 是否验证 PodSecurityPolicy？

Question

我在 Kubernetes 中描述了一个 pod，并从 kubelet 中看到了以下错误：

Warning  FailedCreatePodSandBox  12m (x835 over 36m)    kubelet, ip-1-2-3-4.eu-west-1.compute.internal  (combined from similar events): Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "5608c825cd175d595a89be91a27ba971e4160066a8d4690ef2ab29358dec8675" network for pod "coredns-747c45d54-627wn": NetworkPlugin cni failed to set up pod "coredns-747c45d54-627wn_kube-system" network: connection is unauthorized: pods "coredns-747c45d54-627wn" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.capabilities.add: Invalid value: "NET_BIND_SERVICE": capability may not be added spec.containers[0].securityContext.capabilities.add: Invalid value: "NET_BIND_SERVICE": capability may not be added]

我的问题是关于这unable to validate against any pod security policy部分的——我对 pod 安全策略的理解是，验证检查仅在 apiserver 准入时发生（并且由pod 安全策略准入控制器执行），所以当 kubelet 发现它需要运行一个 pod 时假设它已经过验证，但情况似乎并非如此，并且 kubelet 也在执行验证。

我这样说是否正确，这种行为是否记录在任何地方？还是我误解了错误信息？

Kubernetes 版本：14.1

标签： kubernetes