title: Pod Security Policy not working as intended
body: <p>I am creating a Pod Security Policy to stop ALL users from creating a Pod as Root user. My cluster is on GKE.
  The steps Ive carried out till now are</p>
  
  <p>1) Enable PodSecurityPolicy in my cluster</p>
  
  <pre><code>gcloud beta container clusters update standard-cluster-11  --enable-pod-security-policy
  </code></pre>
  
  <p>2) Define the Policy. The policy is simple and restricts root user.</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: PodSecurityPolicy
  metadata:
    name: a-restrict-root
  spec:
    privileged: false
    runAsUser:
      rule: MustRunAsNonRoot  # &lt;------ Root user restricted.
    seLinux:
      rule: RunAsAny
    fsGroup:
      rule: RunAsAny
    supplementalGroups:
      rule: RunAsAny
    volumes:
    - '*'
  </code></pre>
  
  <p>3) And then ofcourse implementing the correct RBAC rules so that it can be implemented for ALL users.</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: gce:podsecuritypolicy:a-restrict-root
    labels:
      addonmanager.kubernetes.io/mode: Reconcile
      kubernetes.io/cluster-service: "true"
  rules:
  - apiGroups:
    - policy
    resourceNames:
    - a-restrict-root
    resources:
    - podsecuritypolicies
    verbs:
    - use
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: gce:podsecuritypolicy:a-restrict-root
    labels:
      addonmanager.kubernetes.io/mode: Reconcile
      kubernetes.io/cluster-service: "true"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: gce:podsecuritypolicy:a-restrict-root
  subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: system:serviceaccounts
  </code></pre>
  
  <p>Now comes the part where I try to spin up a Pod. The pod definition looks like this :</p>
  
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: security-context-demo
  spec:
    securityContext:
      runAsUser: 0
      fsGroup: 0
    volumes:
    - name: sec-ctx-vol
      emptyDir: {}
    containers:
    - name: sec-ctx-demo
      image: gcr.io/google-samples/node-hello:1.0
      volumeMounts:
      - name: sec-ctx-vol
        mountPath: /data/demo
      securityContext:
        allowPrivilegeEscalation: false
  </code></pre>
  
  <p>As you can see, the <code>runAsUser</code> is set to <code>0</code> meaning <code>root</code>.</p>
  
  <p>When I run <code>kubectl create -f pod.yaml</code>, the pod is creating and goes into <code>Running</code> state.</p>
  
  <p>When I exec into the Pod, I can see all process running as root</p>
  
  <pre><code>$ kubectl exec -it security-context-demo -- sh
  # ps aux
  USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
  root           1  0.0  0.0   4336   812 ?        Ss   19:25   0:00 /bin/sh -c node server.js
  root           6  0.4  0.5 772124 22656 ?        Sl   19:25   0:00 node server.js
  root          11  0.0  0.0   4336   724 ?        Ss   19:26   0:00 sh
  root          16  0.0  0.0  17500  2072 ?        R+   19:26   0:00 ps aux
  </code></pre>
  
  <p>But based on my PodSecurityPolicy this should NOT be allowed. Is there something I have missed ? </p>
  
  <p><strong>UPDATE :</strong></p>
  
  <p>I spun up a default nginx pod that I know always starts as root user. Its manifest is :</p>
  
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: nginx
  spec:
    containers:
    - name: nginx
      image: nginx
  </code></pre>
  
  <p>And when I create it, it too starts up successfully.</p>
  
  <pre><code>$ kubectl get po
  NAME                    READY     STATUS    RESTARTS   AGE
  nginx                   1/1       Running   0          2m
  </code></pre>
  
  <p>Whereas because of the PSP, it should not start up.</p>