What is Kubernetes Pod Security Context AllowPrivilegeEscalation?

Question

Accepted Answer

**AllowPrivilegeEscalation** — prevent process from gaining more privileges.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: no-escalation-pod
spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
```

```bash
kubectl get pod no-escalation-pod -o jsonpath='{.spec.containers[0].securityContext.allowPrivilegeEscalation}'
kubectl exec no-escalation-pod -- cat /proc/1/status | grep CapEff
```

**Default:** true. **Best Practice:** set to false for all containers.

DevOps: What is Kubernetes Pod Security Context AllowPrivilegeEscalation?