create podsecuritypolicies

PodSecurityPolicy was removed in 1.25, so this applies only to older clusters.

A permissive PodSecurityPolicy, once bound, allows any pod spec regardless of security restrictions.

Any subject with a matching binding gets privileged pod execution.

⊘ Removed: 1.25

Note:

PodSecurityPolicy was deprecated in v1.21 and removed in v1.25.

Clusters running v1.25 or later are not affected.

API Group: policy
Scope: cluster
Audit Level: RequestResponse

Escalation Paths

T0podSecurityPolicy bypass (pre-1.25)

Create a permissive PSP and bind it, or delete the restrictive PSP
All pod-security guardrails are removed cluster-wide
Create privileged pods.
This only applies to clusters before 1.25

Additional rights needed:

none

Note:

PodSecurityPolicy removed in 1.25, replaced by Pod Security Admission (PSA).

PSA enforces the Pod Security Standards (PSS), namely Privileged, Baseline, and Restricted, at namespace level via labels (e.g. pod-security.kubernetes.io/enforce: restricted).

K8s docs ↗