<p>How can I apply a PSP (PodSecurityPolicy) only for the <code>kube-system</code> namespace and another PSP for all other namespaces?</p>

Panagiotis Georgiadis
<p>As we can read in the Kubernetes documentation about <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">Pod Security Policies</a>.</p>

<blockquote>
  <p>A <em>Pod Security Policy</em> is a cluster-level resource that controls security sensitive aspects of the pod specification. The <code>PodSecurityPolicy</code> objects define a set of conditions that a pod must run with in order to be accepted into the system, as well as defaults for the related fields.</p>
</blockquote>

<p>You should use <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> and setup <code>Role</code> which will use desired <code>PSP</code>.</p>

<blockquote>
  <p>If a <code>RoleBinding</code> (not a <code>ClusterRoleBinding</code>) is used, it will only grant usage for pods being run in the same namespace as the binding. This can be paired with system groups to grant access to all pods run in the namespace:</p>
</blockquote>

<pre><code># Authorize all service accounts in a namespace:
- kind: Group
  apiGroup: rbac.authorization.k8s.io
  name: system:serviceaccounts
# Or equivalently, all authenticated users in a namespace:
- kind: Group
  apiGroup: rbac.authorization.k8s.io
  name: system:authenticated
</code></pre>

<p>You should also check out <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies" rel="nofollow noreferrer">Using PodSecurityPolicies</a> and <a href="https://medium.com/coryodaniel/kubernetes-assigning-pod-security-policies-with-rbac-2ad2e847c754" rel="nofollow noreferrer">Kubernetes: Assigning Pod Security Policies with RBAC</a>.</p>

<p>Hope this helps.</p>
