<p>I have tried to set up PodSecurityPolicy on a 1.10.1 cluster installed on ubuntu 16.04 with kubeadm, have followed the instructions at <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="noreferrer">https://kubernetes.io/docs/concepts/policy/pod-security-policy/</a></p>

<p>So I altered the apiserver manifest on the master at <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>
adding the <code>",PodSecurityPolicy"</code> to the <code>--admission-control</code> arg</p>

<p>When I do this and run <code>kubectl get pods -n kube-system</code>
the api-server is not listed, obviously I have managed to hit a running instance of the apiserver as I get a list of all the other pods in the kube-system namespace</p>

<p>I can see that a new docker container has been started with the PodSecurityPolicy admission controller and it is obviously serving kubectl requests</p>

<p>When I check the kubelet logs with <code>journalctl -u kubelet</code> I can see</p>

<p><code>Apr 15 18:14:23 pmcgrath-k8s-3-master kubelet[993]: E0415 18:14:23.087361     993 kubelet.go:1617] Failed creating a mirror pod for "kube-apiserver-pmcgrath-k8s-3-master_kube-system(46dbb13cd345f9fbb9e18e2229e2e
dd1)": pods "kube-apiserver-pmcgrath-k8s-3-master" is forbidden: unable to validate against any pod security policy: []</code></p>

<p>I have already added a privileged PSP and created a cluster role and binding and confirmed that the PSP is working</p>

<p>Just not sure why the apiserver kubelet gives this error and therefore does not appear in the pod list, would have thought the kubelet creates this pod and not sure if I have to create a role binding for the apiserver, controller manager, scheduler and kube-dns</p>

<p>No docs indicating how to deal with this, I presume this is a chicken and egg situation, where I have to bootstrap the cluster, add some PSPs, ClusterRoles and ClusterRolebindings before I can mutate the admission-control arg for the api server</p>

<p>Anyone have the same issue or have any pointers on this ?</p>

<p>Thanks
Pat</p>

<p>I have written a blog post on how I figured this stuff out, short answer was</p>

<ul>
<li>On master run kubeadm init with the PodSecurityPolicy admission controller enabled</li>
<li>Add some pod security policies with RBAC config - enough to allow CNI and DNS etc. to start

<ul>
<li>CNI daemonsets will not start without this</li>
</ul></li>
<li>Complete configuring the cluster adding nodes via kubeadm join</li>
<li>As you add more workloads to the cluster check if you need additional pod security policies and RBAC configuration for the same</li>
</ul>

<p>See <a href="https://pmcgrath.net/using-pod-security-policies-with-kubeadm" rel="nofollow noreferrer">https://pmcgrath.net/using-pod-security-policies-with-kubeadm</a></p>
