<p>I have AKS with kubernetes version 1.23. I want to activate podsecurity on cluster level by setting it via AdmissionConfiguration as explained here:</p>
<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/</a></p>
<p>As I have read, &quot;PodSecurity feature gate&quot; is enabled on kubernetes version 1.23 by default. I have created a yaml file based on the configuration that is shown on the link however when I apply it I get the following error:</p>
<pre><code>$ k create -f podsecurity.yaml
error: unable to recognize &quot;podsecurity.yaml&quot;: no matches for kind &quot;AdmissionConfiguration&quot; in version &quot;apiserver.config.k8s.io/v1&quot;

$ kubectl version
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;23&quot;, GitVersion:&quot;v1.23.5&quot;, 
GitCommit:&quot;c285e781331a3785a7f436042c65c5641ce8a9e9&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2022-03-16T15:58:47Z&quot;, GoVersion:&quot;go1.17.8&quot;, Compiler:&quot;gc&quot;, Platform:&quot;windows/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;23&quot;, GitVersion:&quot;v1.23.5&quot;, 
GitCommit:&quot;8211ae4d6757c3fedc53cd740d163ef65287276a&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2022-03-31T20:28:03Z&quot;, GoVersion:&quot;go1.17.8&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>
<p>I googled a lot but couldn't find a solution for it or what it caused it.</p>
<p>I would apprecaite if someone can help.</p>
<p>I am able to activate it in namespace level like it is explained here:
<a href="https://kubernetes.io/docs/tutorials/security/ns-level-pss/" rel="nofollow noreferrer">https://kubernetes.io/docs/tutorials/security/ns-level-pss/</a>
by adding a label under namesapce however I want to activate it on cluster level and it doesn't work.</p>

<p>This is because the administration configuration is not a file to be applied inside the Kubernetes cluster.</p>
<blockquote>
<p>It's a <strong>static</strong> file that must be given to the API-server.</p>
</blockquote>
<p>If your Kubernetes cluster is managed by a clouder and you don't have access to the api-server directly you can use a <a href="https://github.com/kubernetes/pod-security-admission/tree/master/webhook" rel="nofollow noreferrer">pod security admission webhook</a> in your cluster.<br />
It's very simple to install and works very well.</p>
<p>This way you will be able to edit a configmap containing the cluster wide config.</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: pod-security-webhook
  namespace: pod-security-webhook
data:
  podsecurityconfiguration.yaml: |
    apiVersion: pod-security.admission.config.k8s.io/v1beta1
    kind: PodSecurityConfiguration
    defaults:
      enforce: &quot;restricted&quot;
      enforce-version: &quot;latest&quot;
      audit: &quot;restricted&quot;
      audit-version: &quot;latest&quot;
      warn: &quot;restricted&quot;
      warn-version: &quot;latest&quot;
    exemptions:
      # Array of authenticated usernames to exempt.
      usernames: []
      # Array of runtime class names to exempt.
      runtimeClasses: []
      # Array of namespaces to exempt.
      namespaces: [&quot;kube-system&quot;,&quot;policy-test1&quot;]
</code></pre>
<p>For more information I have found the EKS documentation pretty usefull : <a href="https://aws.github.io/aws-eks-best-practices/security/docs/pods/" rel="nofollow noreferrer">https://aws.github.io/aws-eks-best-practices/security/docs/pods/</a></p>
<p><em>You should also note that namespace labels will take precedence over the cluster wide config.</em></p>
