<p>I'm trying to apply podSecurityPolicy and try to test whether it's allowing me to create privileged pod.
Below is the podSecurityPolicy resource manifest.</p>

<pre><code>kind: PodSecurityPolicy
apiVersion: policy/v1beta1
metadata:
 name: podsecplcy
spec:
 hostIPC: false
 hostNetwork: false
 hostPID: false
 privileged: false
 readOnlyRootFilesystem: true
 hostPorts:
 - min: 10000
   max: 30000
 runAsUser:
  rule: RunAsAny
 fsGroup:
    rule: RunAsAny
 supplementalGroups:
    rule: RunAsAny
 seLinux:
    rule: RunAsAny
 volumes:
 - '*'
</code></pre>

<p>current psp as below</p>

<pre><code>[root@master ~]# kubectl get psp
NAME         PRIV    CAPS   SELINUX    RUNASUSER   FSGROUP    SUPGROUP   READONLYROOTFS   VOLUMES
podsecplcy   false          RunAsAny   RunAsAny    RunAsAny   RunAsAny   true             *
[root@master ~]#
</code></pre>

<p>After submitted the above manifest,i'm trying to create privileged pod using below manifest.</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: pod-privileged
spec:
  containers:
  - name: main
    image: alpine
    command: ["/bin/sleep", "999999"]
    securityContext:
      privileged: true
</code></pre>

<p>Without any issues the pod is created.I hope it should throw error since privileged pod creation is restricted through podSecurityPolicy.
Then i realized,it may be a admission controller plugin is not enabled and i saw which admission controller plugins are enabled by describe the kube-apiserver pod(Removed some lines for readability purpose) and able to see only NodeRestriction is enabled </p>

<pre><code>[root@master ~]# kubectl -n kube-system describe po kube-apiserver-master.k8s
      --client-ca-file=/etc/kubernetes/pki/ca.crt
      --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true

**Attempt:**
Tried to edit /etc/systemd/system/multi-user.target.wants/kubelet.service and changed ExecStart=/usr/bin/kubelet --enable-admission-plugins=Initializers,NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
restarted kubelet service.But no luck

Now how to enable other admission controller plugins?
</code></pre>

JPNagarajan
<p><strong>1.</strong> Locate the static pod manifest-path</p>

<p>From systemd status, you will be able to locate the kubelet unit file 
<code>systemctl status kubelet.service</code></p>

<p>Do <code>cat /etc/systemd/system/kubelet.service</code> (replace path with the one you got from above command)
Go to the directory which is pointing to <code>--pod-manifest-path=</code></p>

<p><strong>2.</strong> Open the yaml which starts kube-apiserver-master.k8s Pod</p>

<p>Example steps to locate YAML is below</p>

<pre><code>cd /etc/kubernetes/manifests/
grep kube-apiserver-master.k8s *
</code></pre>

<p><strong>3.</strong> Append <code>PodSecurityPolicy</code> to flag <code>--enable-admission-plugins=</code> in YAML file</p>

<p><strong>4.</strong> Create a PSP and corresponding bindings for kube-system namespace</p>

<p>Create a PSP to grant access to pods in kube-system namespace including CNI</p>

<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
 annotations:
  seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
 name: privileged
spec:
 allowedCapabilities:
 - '*'
 allowPrivilegeEscalation: true
 fsGroup:
  rule: 'RunAsAny'
 hostIPC: true
 hostNetwork: true
 hostPID: true
 hostPorts:
 - min: 0
   max: 65535
 privileged: true
 readOnlyRootFilesystem: false
 runAsUser:
  rule: 'RunAsAny'
 seLinux:
  rule: 'RunAsAny'
 supplementalGroups:
  rule: 'RunAsAny'
 volumes:
  - '*'
EOF
</code></pre>

<p>Cluster role which grants access to the privileged pod security policy</p>

<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: privileged-psp
rules:
 - apiGroups:
   - policy
   resourceNames:
   - privileged
   resources:
   - podsecuritypolicies
   verbs:
   - use
EOF
</code></pre>

<p>Role binding</p>

<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
 name: kube-system-psp
 namespace: kube-system
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: privileged-psp
subjects:
 - apiGroup: rbac.authorization.k8s.io
   kind: Group
   name: system:nodes
 - apiGroup: rbac.authorization.k8s.io
   kind: Group
   name: system:serviceaccounts:kube-system
EOF
</code></pre>
