title: Why is my PodSecurityPolicy applied even if I don't have access?
body: <p>I have two PodSecurityPolicy:</p>
  
  <ul>
  <li>000-privileged (only kube-system service accounts and admin users)</li>
  <li>100-restricted (everything else)</li>
  </ul>
  
  <p>I have a problem with their assignment to pods.</p>
  
  <p>First policy binding:</p>
  
  <pre><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: psp:privileged
  rules:
  - apiGroups:
    - extensions
    resources:
    - podsecuritypolicies
    resourceNames:
    - 000-privileged
    verbs:
    - use
  ---
  kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: psp:privileged-kube-system
    namespace: kube-system
  subjects:
  - kind: Group
    name: system:serviceaccounts
    apiGroup: rbac.authorization.k8s.io
  roleRef:
    kind: ClusterRole
    name: psp:privileged
    apiGroup: rbac.authorization.k8s.io
  </code></pre>
  
  <p>Second policy binding:</p>
  
  <pre><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: psp:restricted
  rules:
  - apiGroups:
    - extensions
    resources:
    - podsecuritypolicies
    resourceNames:
    - 100-restricted
    verbs:
    - use
  ---
  kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: psp:restricted
  subjects:
  - kind: Group
    name: system:authenticated
    apiGroup: rbac.authorization.k8s.io
  - kind: Group
    name: system:serviceaccounts
    apiGroup: rbac.authorization.k8s.io
  roleRef:
    kind: ClusterRole
    name: psp:restricted
    apiGroup: rbac.authorization.k8s.io
  </code></pre>
  
  <p>Everything works fine in kube-system.</p>
  
  <p>However, in other namespaces, it does not work as expected:</p>
  
  <ul>
  <li><p>If I create a Deployment (kubectl apply -f deployment.yml), its pod gets tagged with psp 100-restricted.</p></li>
  <li><p>If I create a Pod (kubectl apply -f pod.yml), it gets tagged with psp 000-privileged. <strong>I really don't get why its not 100-restricted.</strong></p></li>
  </ul>
  
  <p>My kubectl is configured with external authentication token from OpenID Connect (OIDC). </p>
  
  <p>I verified the access and everything seems ok:</p>
  
  <pre><code>kubectl auth can-i use psp/100-restricted
  yes
  kubectl auth can-i use psp/000-privileged
  no
  </code></pre>
  
  <p>Any clue?</p>