Привет! Подскажите по psp, пожалуйста, почему данная psp не запрещает

запуститься поду?

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: false # Required to prevent escalations to root.
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
- 'persistentVolumeClaim' # Assume persistentVolumes set up by admin are safe
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'MustRunAsNonRoot' # Require the container to run without root seLinux:
seLinux:
rule: 'RunAsAny' # This assumes nodes are using AppArmor rather than SELinux
supplementalGroups:
rule: 'MustRunAs'
ranges: # Forbid adding the root group.
- min: 1
max: 65535
runAsGroup:
rule: 'MustRunAs'
ranges: # Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges: # Forbid adding the root group.
- min: 1
max: 65535
readOnlyRootFilesystem: true

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: psp:restricted
rules:
- apiGroups:
- policy
resourceNames:
- restricted
resources:
- podsecuritypolicies
verbs:
- use

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: psp:any:restricted
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: psp:restricted
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated

---
apiVersion: v1
kind: Pod
metadata:
name: privileged
spec:
containers:
- name: pause
image: k8s.gcr.io/pause
securityContext:
privileged: true
runAsUser: 0
hostPID: true
hostNetwork: true

admission-plugins включил предварительно, но psp не заработали

на cluster admin это не работает. Создай под от сервис аккаунта, или deployment сделай вместо пода