A reviewer rejects privileged: true on a routine citizen portal Deployment. Why is that setting inappropriate for ordinary application Pods?
Select an answer to reveal the explanation.
Short Explanation
privileged is the "full host toolkit" badge—fine for rare system helpers, not for a citizen web app. Ordinary Pods should stay constrained. It isn't a DNS or read-only-root requirement, and kubelets still honor it.
Full Explanation
privileged: true places a container in a nearly host-equivalent capability mode, collapsing much of the isolation that makes containers appropriate for multi-tenant city platforms. Reviewers correctly reject that setting on a routine citizen portal Deployment because ordinary application workloads must not receive host-level powers. CKAD-level application security expects citizen-facing services to run unprivileged, with explicit capability drops, non-root users, and no privileged flag unless there is a rare, justified system-software exception outside normal app scope.
The claim that privileged only affects DNS resolution, or that every ClusterIP Service requires it, is false: ClusterIP networking and DNS work for constrained Pods. privileged is not mandatory when readOnlyRootFilesystem is true; those settings address different concerns, and privileged undermines the intent of a read-only root. privileged is not ignored by modern kubelets—when set, it is enforced and dangerous—so leaving it true is not a harmless no-op for reviewers to overlook.
Exam caveat: do not confuse privileged: true with merely adding one capability; privileged is a broad escape hatch. If a portal truly needs one capability (uncommon), add that capability explicitly rather than enabling privileged. Operational check: grep Deployments for privileged: true in the citizen portal namespace and remove it; confirm Pods still pass readiness with runAsNonRoot, allowPrivilegeEscalation false, and dropped capabilities. City security baselines and Pod Security restricted policies typically forbid privileged containers for ordinary apps—treat a reject from policy admission as expected and correct.