<p>I trying to make a PodsSecurityPolicy on my Kubernetes Cluster and I got a Official manual from <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">here</a></p>
<p>Itn't work: I made all steps on my Kubernetes Cluter, but I can't to get a Forbidden massage.</p>
<p>My Kubernetes-cluster:</p>
<pre><code>nks@comp:~$ kubectl version
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;18&quot;, GitVersion:&quot;v1.18.0&quot;, GitCommit:&quot;9e991415386e4cf155a24b1da15becaa390438d8&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-03-25T14:58:59Z&quot;, GoVersion:&quot;go1.13.8&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;17&quot;, GitVersion:&quot;v1.17.4&quot;, GitCommit:&quot;8d8aa39598534325ad77120c120a22b3a990b5ea&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-03-12T20:55:23Z&quot;, GoVersion:&quot;go1.13.8&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>
<p>Steps in my case (I marked trhe places &quot;(?!)&quot; where I should get the Forbidden-message but didn't it):</p>
<pre><code>nks@comp:~$ cat psp.yml 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: nksrole
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames:
  - example
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: nkscrb
roleRef:
  kind: ClusterRole
  name: nksrole
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: Group
  apiGroup: rbac.authorization.k8s.io
  name: system:serviceaccounts
---


nks@comp:~$ kubectl apply -f psp.yml
clusterrole.rbac.authorization.k8s.io/nksrole created
clusterrolebinding.rbac.authorization.k8s.io/nkscrb created
nks@comp:~$ kubectl create namespace psp-example
namespace/psp-example created
nks@comp:~$ kubectl create serviceaccount -n psp-example fake-user
serviceaccount/fake-user created
nks@comp:~$ kubectl create rolebinding -n psp-example fake-editor --clusterrole=edit --serviceaccount=psp-example:fake-user
rolebinding.rbac.authorization.k8s.io/fake-editor created
nks@comp:~$ alias kubectl-admin='kubectl -n psp-example'
nks@comp:~$ alias kubectl-user='kubectl --as=system:serviceaccount:psp-example:fake-user -n psp-example'
nks@comp:~$ cat example-psp.yaml 
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: example
spec:
  privileged: false  # Don't allow privileged pods!
  # The rest fills in some required fields.
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
  - '*'
nks@comp:~$ kubectl-admin create -f example-psp.yaml
podsecuritypolicy.policy/example created
nks@comp:~$ kubectl-user create -f- &lt;&lt;EOF
&gt; apiVersion: v1
&gt; kind: Pod
&gt; metadata:
&gt;   name:      pause
&gt; spec:
&gt;   containers:
&gt;     - name:  pause
&gt;       image: k8s.gcr.io/pause
&gt; EOF
pod/pause created
nks@comp:~$ kubectl-user auth can-i use podsecuritypolicy/example
Warning: resource 'podsecuritypolicies' is not namespace scoped in group 'policy'
yes
(?!)
nks@comp:~$ kubectl-admin create role psp:unprivileged \
&gt;     --verb=use \
&gt;     --resource=podsecuritypolicy \
&gt;     --resource-name=example
role.rbac.authorization.k8s.io/psp:unprivileged created
nks@comp:~$ kubectl-admin create rolebinding fake-user:psp:unprivileged \
&gt;     --role=psp:unprivileged \
&gt;     --serviceaccount=psp-example:fake-user
rolebinding.rbac.authorization.k8s.io/fake-user:psp:unprivileged created
nks@comp:~$ kubectl-user auth can-i use podsecuritypolicy/example
Warning: resource 'podsecuritypolicies' is not namespace scoped in group 'policy'
yes
nks@comp:~$ kubectl-user create -f- &lt;&lt;EOF
&gt; apiVersion: v1
&gt; kind: Pod
&gt; metadata:
&gt;   name:      privileged
&gt; spec:
&gt;   containers:
&gt;     - name:  pause
&gt;       image: k8s.gcr.io/pause
&gt;       securityContext:
&gt;         privileged: true
&gt; EOF
pod/privileged created
(?!)
</code></pre>
<p>Can you help me, please! I have not idea what is wrong</p>

Piknik
<p>Your cluster version is v1.17.4 and the feature is beta in v1.18 , try after upgrading your cluster.</p>
<p>Also make sure admission controller is enabled for Pod Security Policies,</p>
