Migrating from PSP to PSA (Kube/AKS 1.24 prior to 1.25 upgrade)

General Discussions
,
1

Cluster information:

Kubernetes version: 1.24.10
Cloud being used: AKS
Installation method: n/a
Host OS: Linux 18.04.6 LTS
CNI and version: Calico
CRI and version: Containerd

I’ve added the following labels to my namespace:

pod-security.kubernetes.io/enforce=restricted
pod-security.kubernetes.io/warn=restricted
pod-security.kubernetes.io/warn-version=latest

All is fine and dandy but when i try to apply this Privileged Pod in that namespace, it allows the create, no warning is thrown and also the pods starts up, I would have expected a warning and also the pods being blocked being created to to the most restrictive enforcement

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes
  namespace: psp-psa-test-ns
  labels:
    product: hello-kubernetes
    team: forward-deployed-engineering
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello-kubernetes 
  template:
    metadata:
      labels:
        app: hello-kubernetes
    spec:
      containers:
      - name: api-server
        image: nginxdemos/hello
        imagePullPolicy: Always
        ports:
        - containerPort: 80
        securityContext:
          allowPrivilegeEscalation: true
          privileged: true
          capabilities:
            add: ["NET_ADMIN"]
        resources:
          requests:
            memory: "8Mi"
            cpu: "32m"
          limits:
            memory: "16Mi"
            cpu: "64m"
      tolerations:
      - key: "kubernetes.azure.com/scalesetpriority"
        value: "spot"
        effect: "NoSchedule"

Been going at this for 5 hours now, starting to get bald ripping my hairs out :smiley: so if any one have any suggestions my hairline will greatly appreciate it :slight_smile: