How to use privilege container with Volcano?

[goversion]

What happened:

I need to use privilege level in a volcano job's yaml file, which is to add “privileged: true” to the yaml file.

When creating the job, the following error will be reported.

$ kubectl create -f abc.yaml
Error from server: error when creating "abc.yaml":
admission webhook "validatejob.volcano.sh" denied the request:
spec.task[0].template.spec.containers[0].securityContext.privileged:
Forbidden: disallowed by cluster policy.
spec.task[1].template.spec.containers[0].securityContext.privileged:
Forbidden: disallowed by cluster policy.

Note that kube-apiserver and kubelet have been set "privilege=true".

Enter the following command to delete the settings related to volcano admission. I can avoid the above error when creating the job, then the job can use privilege level.

$ kubectl delete validatingwebhookconfiguration volcano-admission-service-validate-job

However, the problem is that volcano admission does not verify the fields in the yaml file at all, which is not good.

What better solution does the community have, please? Thanks!

What you expected to happen:
I would like to add “privileged: true” to a volcano job's yaml file, this is not allowed at present.

How to reproduce it (as minimally and precisely as possible):

1. enable kube-apiserver with --allow-privileged=true ...
2. enable kubelet with --allow-privileged=true ...
3. Create a sample volcano job yaml file and add "privileged: true" field to the yaml. then create the job with command "kubectl apply".

Environment
Volcano Version : The latest version
kubernetes version : 1.14.3

[hzxuzhonghu]

@goversion Thanks for reporting, it seems a bug, which we did not consider before.

[k82cn]

/assign @hzxuzhonghu , would you help on that?

[hzxuzhonghu]

/assign

[hzxuzhonghu]

Given to the validation in-consistent in volcano and kube-apiserver. I would suggest introducing max-retry to volcano, so we can prevent endless retry.

[hzxuzhonghu]

Maybe i should file a new issue.