How to fix capability not allowed in Kubernetes

Review pod events and container logs for specific capability:

kubectl describe pod <pod-name>
kubectl logs <pod-name>

Look for capability name in error message (e.g., CAP_NET_ADMIN).

Know what capabilities are allowed at each level:

kubectl get psp  # Check Pod Security Policies
kubectl label namespace default pod-security.kubernetes.io/enforce=baseline

Restricted (default): no capabilities
Baseline: allows some common ones
Unrestricted: allows most

Start with secure baseline and add only what is needed:

securityContext:
  capabilities:
    drop:
      - ALL
    add:
      - NET_BIND_SERVICE
      - NET_RAW

Always use UPPERCASE for capability names.

Linux capabilities must be in UPPERCASE with CAP_ prefix:
- Correct: CAP_NET_ADMIN, CAP_SYS_TIME, CAP_NET_BIND_SERVICE
- Wrong: cap_net_admin, NetAdmin, net_admin
See Linux man pages for full list of capabilities.

By default, non-root containers cannot use capabilities. If needed:

securityContext:
  runAsUser: 0  # Run as root
  capabilities:
    add:
      - CAP_NET_ADMIN

Prefer dropping ALL and adding specific capabilities instead.

For workloads needing capabilities, adjust namespace policy:

kubectl label namespace default \
  pod-security.kubernetes.io/enforce=baseline \
  --overwrite

Use baseline carefully - unrestricted is rarely needed.

Verify AppArmor/SELinux is not blocking capability:

kubectl get pod <pod> -o yaml | grep -i apparmor
grep DENIED /var/log/audit/audit.log

Update AppArmor profile to allow capability if necessary.

Test pod locally before cluster deployment:

kubectl apply -f pod.yaml --dry-run=server

This validates against current Pod Security Policies.