cert-manager pods report PodSecurity "restricted" violations during restart on Supervisor nodes

Products

• Tanzu Kubernetes Runtime

Issue/Introduction

When restarting the cert-manager pods on Supervisor nodes, the following warnings are observed in the logs or via kubectl events:

kubectl rollout restart deploy -n vmware-system-cert-manager cert-manager

Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), seccompProfile (pod or container "cert-manager-controller" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
deployment.apps/cert-manager restarted

Environment

vSphere Kubernetes Service

Cause

This behavior is expected in environments where the Kubernetes Pod Security Admission (PSA) controller is active. The PSA controller evaluates all pods against specific security profiles (such as restricted, baseline, or privileged).

The VMware system cert-manager requires specific elevated permissions to function correctly on Supervisor nodes:

• hostNetwork=true: Required for direct communication on the host node's network.
• seccompProfile: Requires the ability to bypass default system call restrictions to manage certificates effectively.

While Kubernetes flags these settings as violations of the restricted security profile, they are necessary for the component's operation.

Resolution

The warnings indicate that the pods are running with the elevated permissions required for their intended function.

No action is required. You can safely ignore these warnings as they do not impact the successful operation or restart of the cert-manager deployment.