<p>I have a K8S cluster running in Azure AKS service.</p>
<p>I want to enforce <strong>MustRunAsNonRoot</strong> policy. How to do it?</p>
<p>The following policy is created:</p>
<pre><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restrict-root
spec:
  privileged: false
  allowPrivilegeEscalation: false
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'
</code></pre>
<p>It is deployed in the cluster:</p>
<pre><code>$ kubectl get psp
NAME                            PRIV    CAPS   SELINUX    RUNASUSER          FSGROUP     SUPGROUP    READONLYROOTFS   VOLUMES
restrict-root                   false          RunAsAny   MustRunAsNonRoot   RunAsAny    RunAsAny    false            *
</code></pre>
<p>Admission controller is running in the cluster:</p>
<pre><code>$ kubectl get pods -n gatekeeper-system
NAME                                     READY   STATUS    RESTARTS   AGE
gatekeeper-audit-7b4bc6f977-lvvfl        1/1     Running   0          32d
gatekeeper-controller-5948ddcd54-5mgsm   1/1     Running   0          32d
gatekeeper-controller-5948ddcd54-b59wg   1/1     Running   0          32d
</code></pre>
<p>Anyway it is possible to run a simple pod running under root:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name:      mypod
spec:
  containers:
    - name:  mypod
      image: busybox
      args: [&quot;sleep&quot;, &quot;10000&quot;]
      securityContext:
        runAsUser: 0
</code></pre>
<p>Pod is running:</p>
<pre><code>$ kubectl describe po mypod
Name:         mypod
Namespace:    default
Priority:     0
Node:         aks-default-31327534-vmss000001/10.240.0.5
Start Time:   Mon, 08 Feb 2021 23:10:46 +0100
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Status:       Running
</code></pre>
<p>Why <strong>MustRunAsNonRoot</strong> is not applied? How to enforce it?</p>
<p>EDIT: It looks like AKS engine does not support PodSecurityPolicy (<a href="https://learn.microsoft.com/en-us/azure/aks/faq#what-kubernetes-admission-controllers-does-aks-support-can-admission-controllers-be-added-or-removed" rel="noreferrer">list of supported policies</a>). Then the question is still the same: how to enforce MustRunAsNonRoot rule on workloads?</p>

Michael Chudinov
<p>You shouldn't use <code>PodSecurityPolicy</code> on <strong>Azure AKS cluster</strong> as it has been set for deprecation as of May 31st, 2021 in favor of <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-on-azure-policy" rel="nofollow noreferrer">Azure Policy for AKS</a>. Check <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-policies" rel="nofollow noreferrer">the official docs</a> for further details:</p>
<blockquote>
<p>Warning</p>
<p><strong>The feature described in this document, pod security policy (preview), is set for deprecation and will no longer be available
after May 31st, 2021</strong>  in favor of  <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-on-azure-policy" rel="nofollow noreferrer">Azure Policy for
AKS</a>.
The deprecation date has been extended from the previous date of
October 15th, 2020.</p>
</blockquote>
<p>So currently you should rather use <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-on-azure-policy" rel="nofollow noreferrer">Azure Policy for AKS</a>, where <a href="http://Azure%20Policy%20for%20Kubernetes%20offers%20two%20built-in%20initiatives,%20which%20secure%20pods,%20baseline%20and%20restricted." rel="nofollow noreferrer">among other built-in policies</a> grouped into initiatives (an initiative in Azure Policy is a collection of policy definitions that are tailored towards achieving a singular overarching goal), you can find a policy which goal is to <a href="https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F95edb821-ddaf-4404-9732-666045e056b4" rel="nofollow noreferrer">disallow running of privileged containers</a> on your <strong>AKS cluster</strong>.</p>
<p>As to <code>PodSecurityPolicy</code>, for the time being it should still work. Please check <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-policies#create-a-custom-pod-security-policy" rel="nofollow noreferrer">here</a> if you didn't forget about anything e.g. make sure you <a href="https://learn.microsoft.com/en-us/azure/aks/use-pod-security-policies#allow-user-account-to-use-the-custom-pod-security-policy" rel="nofollow noreferrer">set up the corresponding <code>ClusterRole</code> and <code>ClusterRoleBinding</code></a> to allow the policy to be used.</p>
