title: Why is my Pod Security Policy not stopping the use of root user in a pod?
body: <p>I'm trying to deploy a restricted psp which should disable the use of the root user in a pod:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: policy/v1beta1
  kind: PodSecurityPolicy
  metadata:
    name: unprivilegedpolicy
  spec:
    privileged: false
    allowPrivilegeEscalation: false
    requiredDropCapabilities:
      - ALL
    volumes:
      - 'configMap'
      - 'emptyDir'
      - 'projected'
      - 'secret'
      - 'downwardAPI'
      - 'persistentVolumeClaim'
    hostNetwork: false
    hostIPC: false
    hostPID: false
    runAsUser:
      rule: 'MustRunAsNonRoot'
    seLinux:
      rule: 'RunAsAny'
    supplementalGroups:
      rule: 'MustRunAs'
      ranges:
        - min: 1
          max: 65535
    fsGroup:
      rule: 'MustRunAs'
      ranges:
        - min: 1
          max: 65535
    readOnlyRootFilesystem: false
  </code></pre>
  <p>I've added this psp to a ClusterRole and bound it to the namespace <code>hello-world</code>:</p>
  <pre><code>Name:         UnPrivilegedClusterRole
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  PolicyRule:
    Resources                   Non-Resource URLs  Resource Names        Verbs
    ---------                   -----------------  --------------        -----
    podsecuritypolicies.policy  []                 [unprivilegedpolicy]  [use]
  
  [root@master01 ~]# kubectl describe clusterrolebindings.rbac.authorization.k8s.io HelloWorldRoleBinding
  Name:         HelloWorldRoleBinding
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  Role:
    Kind:  ClusterRole
    Name:  UnPrivilegedClusterRole
  Subjects:
    Kind   Name                    Namespace
    ----   ----                    ---------
    Group  system:serviceaccounts  hello-world
  </code></pre>
  <p>BUT if I try to run a ngnix container using <code>kubectl run --name=nginx hello-world</code> the container successfully runs as root user. The deployment is deployed via a ServiceAccount.</p>
  <p>The PodSecurityPolicy admission controller is enabled.</p>
  <p>Does anybody has a solution for this?</p>