delete podsecuritypolicies
PodSecurityPolicy was removed in 1.25, so this applies only to older clusters.
Deleting a restrictive PodSecurityPolicy removes all pod-security guardrails cluster-wide immediately, letting privileged pods run unrestricted.
Note:
PodSecurityPolicy was deprecated in v1.21 and removed in v1.25.
Clusters running v1.25 or later are not affected.
- API Group
- policy
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create a permissive PSP and bind it, or delete the restrictive PSP
All pod-security guardrails are removed cluster-wide
Create privileged pods.
This only applies to clusters before 1.25
Additional rights needed:
Note:
PodSecurityPolicy removed in 1.25, replaced by Pod Security Admission (PSA).
PSA enforces the Pod Security Standards (PSS), namely Privileged, Baseline, and Restricted, at namespace level via labels (e.g. pod-security.kubernetes.io/enforce: restricted).