This message was deleted.

because they do things that require privilege

Can you elaborate a bit more on what things? I mean, all of the Rancher pods ignore k8s best practices like not running as root, running privileged, not setting any requests and limits. You should have reasons for that and should be able to describe them.

Have you compared it with, let's say, kubeadm? I think that's also the case for a lot of core components. It's hard, if not impossible, to change things related to the kernel, network, etc. otherwise, I'd assume.

I did not. And I agree, some components need to run privileged, like a CNI, kubelet and kube-proxy, the Rancher agent or the system-upgrade-controller. But everything else could and should run with least privileges and with requests and limits.

When you say 'everything else', which ones are you referring to concretely?

E.g. the one container I mentioned in the beginning. Suse should answer that question.