kubernetes: kubectl debug failed to add ephemeral container with kubernetes 1.25

What happened?

We encountered an issue that Ephemeral container created failed using kubectl debug with restricted PSA, the Kubernetes is v1.25.4 and kubectl is v1.24.1.

[root@vz0005-tgh25-master-0 ~]# kubectl debug -n psa testclient-848997fb8-dlcsn -it --image=registry.redhat.io/rhel8/support-tools:latest – bash Defaulting debug container name to debugger-wjzcc. Error from server (Forbidden): pods “testclient-848997fb8-dlcsn” is forbidden: violates PodSecurity “restricted:v1.24”: allowPrivilegeEscalation != false (container “debugger-wjzcc” must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container “debugger-wjzcc” must set securityContext.capabilities.drop=[“ALL”]), runAsNonRoot != true (pod or container “debugger-wjzcc” must set securityContext.runAsNonRoot=true)

What did you expect to happen?

kubectl debug to add ephemeral container successfully base on psa.

How can we reproduce it (as minimally and precisely as possible)?

Add Ephemeral container to one existing running pod with restricted PSA. command like below: kubectl debug testclient-848997fb8-dlcsn -it --image=registry.redhat.io/rhel8/support-tools:latest – bash

Anything else we need to know?

No response

Kubernetes version

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
NAME="Red Hat Enterprise Linux CoreOS"
ID="rhcos"
ID_LIKE="rhel fedora"
VERSION="412.86.202301061548-0"
VERSION_ID="4.12"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux CoreOS 412.86.202301061548-0 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::coreos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://docs.openshift.com/container-platform/4.12/"
BUG_REPORT_URL="https://access.redhat.com/labs/rhir/"
REDHAT_BUGZILLA_PRODUCT="OpenShift Container Platform"
REDHAT_BUGZILLA_PRODUCT_VERSION="4.12"
REDHAT_SUPPORT_PRODUCT="OpenShift Container Platform"
REDHAT_SUPPORT_PRODUCT_VERSION="4.12"
OPENSHIFT_VERSION="4.12"
RHEL_VERSION="8.6"
OSTREE_VERSION="412.86.202301061548-0"

$ uname -a
Linux vz0005-tgh25-master-0 4.18.0-372.40.1.el8_6.x86_64 #1 SMP Tue Jan 3 09:45:26 EST 2023 x86_64 x86_64 x86_64 GNU/Linux

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, …) and versions (if applicable)