Kyverno / Pod Security "restricted" policy blocks okteto-bin and okteto-init-volume init containers

Help
1

Our Kyverno / Pod Security “restricted” policy blocks the okteto-bin and okteto-init-volume init containers on okteto up. How do I make them compliant?

2

Those init containers don’t inherit the pod’s securityContext; they only get what you set under dev.<name>.securityContext in okteto.yml. Add the restricted fields there:

dev:
  api:
    securityContext:
      runAsUser: 1001
      runAsGroup: 1001
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]

seccompProfile and privileged aren’t configurable in the manifest yet, and readOnlyRootFilesystem must stay off for these init containers (they write files). Add a policy exception for those fields if needed.

See Okteto Manifest reference.