<p>I can't start pod which requires privileged security context.
PodSecurityPolicy:</p>

<pre><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: pod-security-policy
spec:
  privileged: true
  allowPrivilegeEscalation: true
  readOnlyRootFilesystem: false
  allowedCapabilities:
  - '*'
  allowedProcMountTypes:
  - '*'
  allowedUnsafeSysctls:
  - '*'
  volumes:
  - '*'
  hostPorts:
  - min: 0
    max: 65535
  hostIPC: true
  hostPID: true
  hostNetwork: true
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
</code></pre>

<p>ClusterRole:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: privileged
rules:
- apiGroups:
  - '*'
  resourceNames:
  - pod-security-policy
  resources:
  - '*'
  verbs:  
  - '*'
</code></pre>

<p>ClusterRoleBinding:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: privileged-role-binding
roleRef:
  kind: ClusterRole
  name: privileged
  apiGroup: rbac.authorization.k8s.io
subjects:
# Authorize specific service accounts:
- kind: ServiceAccount
  name: default 
  namespace: kube-system
- kind: ServiceAccount
  name: default 
  namespace: default 
- kind: Group
#  apiGroup: rbac.authorization.k8s.io
  name: system:authenticated
# Authorize specific users (not recommended):
- kind: User
  apiGroup: rbac.authorization.k8s.io
  name: admin
</code></pre>

<pre><code>$ k auth can-i use psp/pod-security-policy
Warning: resource 'podsecuritypolicies' is not namespace scoped in group 'extensions'
yes
$ k apply -f daemonset.yml 
The DaemonSet "daemonset" is invalid: spec.template.spec.containers[0].securityContext.privileged: Forbidden: disallowed by cluster policy
</code></pre>

<p>Not sure if it is needed but I have added PodSecurityContext to args/kube-apiserver <code>--enable-admission-plugins</code></p>

<p>Any advice and insight is appreciated.  WTF is this: "It looks like your post is mostly code; please add some more details." !?!</p>

Kok How Teh
<p>Just checked your Pod Security <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="noreferrer">Policy</a> configuration on my current environment: </p>

<pre><code>kubeadm version: &amp;version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1"
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1"
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1"
</code></pre>

<p>I assume that you've included Privileged <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="noreferrer">securityContext</a> in the current DaemonSet manifest file.</p>

<pre><code>securityContext:
  privileged: true
</code></pre>

<p>In order to allow Kubernetes API spawning <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged" rel="noreferrer">Privileged</a> containers you might have to set <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/" rel="noreferrer">kube-apiserver</a> flag <code>--allow-privileged</code> to <code>true</code> value.</p>

<p><code>--allow-privileged=true</code></p>

<p>Therefore, I'm facing the same issue in my k8s cluster, once I disallow to run privileged containers with <code>false</code> option.</p>
