<p>What's the best method to enforce/block root containers running in an EKS cluster running managed nodes and applied to all namespaces (except kube-system) v1.22+ ?  I tried the below but root containers are still able to run.  Is this the latest method <a href="https://kubernetes.io/docs/tutorials/security/cluster-level-pss/" rel="nofollow noreferrer">https://kubernetes.io/docs/tutorials/security/cluster-level-pss/</a>?</p>
<pre><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: pod-security
spec:
  privileged: true
  seLinux:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  runAsUser:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  volumes:
  - '*'
</code></pre>

risail
<p>The answer is use a tool like kyverno or datree and enforce policies and audit them from the cluster build point</p>
<p><a href="https://kyverno.io/policies/pod-security/baseline/disallow-privileged-containers/disallow-privileged-containers/" rel="nofollow noreferrer">https://kyverno.io/policies/pod-security/baseline/disallow-privileged-containers/disallow-privileged-containers/</a></p>
