[Question]Pod security policy deprecation

[mo-saeed]

Hi Guys,

in here it's written that pod security policy will not be longer available after May 31st but based on Kubernetes up-stream kubernetes/enhancements#5 (comment) PSP will be removed in kubernetes 1.25 so the question is, will PSP in AKS still usable after May 31st and till 1.25 release?

Thanks

[ghost]

Hi mo-saeed, AKS bot here 👋
Thank you for posting on the AKS Repo, I'll do my best to get a kind human from the AKS team to assist you.

I might be just a bot, but I'm told my suggestions are normally quite good, as such:

1. If this case is urgent, please open a Support Request so that our 24/7 support team may help you faster.
2. Please abide by the AKS repo Guidelines and Code of Conduct.
3. If you're having an issue, could it be described on the AKS Troubleshooting guides or AKS Diagnostics?
4. Make sure your subscribed to the AKS Release Notes to keep up to date with all that's new on AKS.
5. Make sure there isn't a duplicate of this issue already reported. If there is, feel free to close this one and '+1' the existing issue.
6. If you have a question, do take a look at our AKS FAQ. We place the most common ones there!

[ghost]

Triage required from @Azure/aks-pm

[ghost]

Action required from @Azure/aks-pm

[ghost]

@ruchikaguptaa, @az-policy-kube would you be able to assist?

Issue Details

---

Hi Guys,

in here it's written that pod security policy will not be longer available after May 31st but based on Kubernetes up-stream kubernetes/enhancements#5 (comment) PSP will be removed in kubernetes 1.25 so the question is, will PSP in AKS still usable after May 31st and till 1.25 release?

Thanks

Author:	mo-saeed
Assignees:	-
Labels:	Needs Attention :wave:, action-required, addon/policy, azure/policy, triage
Milestone:	-

[az-policy-kube]

@az-policy-kube would you be able to assist?

[miwithro]

@mo-saeed we will be pushing the deprecation date to 06.30.2021. So you can continue to use PSP until that date. After that you will need to use Azure Policy. I am in the process of updating the document to reflect that date as well.

[mo-saeed]

@miwithro Thank you for your reply but that doesn't answer my question, even if AKS deprecates PSP will we still be able to use it in our cluster till it's deprecated in the upstream?

[miwithro]

No you will not.

[pakoAku]

@miwithro can you clarify on this please:

How do I need to understand this:
06.30.2021 - all running AKS cluster, from all customer with any Kubernetes version will stop support PSP
or
06.30.2021 - all AKS Cluster which will be upgraded to Kubernetes 1.2x or get created after the 06.30.2021 will stop support PSP

I was in a discussion with the Azure Support and I understood it will stop working only after upgrade to specific Kubernetes version or newly created cluster.
This would give everybody time and control on when to upgrade.

[miwithro]

Hello,
To be more clear.

After pod security policy (preview) is deprecated, you must disable the feature on any existing clusters using the deprecated feature to perform future cluster upgrades and stay within Azure support. So in short, they can continue to use as long as they don’t upgrade.

[pakoAku]

Thank you for the clarification.

[ghost]

Action required from @Azure/aks-pm

[miwithro]

@mo-saeed @pakoAku

We have updated our guidance around Pod Security Policies:

Pod security policy (preview), will begin deprecation with Kubernetes version 1.21, with its removal in version 1.25. As Kubernetes Upstream approaches that milestone, the Kubernetes community will be working to document viable alternatives. The previous deprecation announcement was made at the time as there was not a viable option for customers. Now that the Kubernetes community is working on an alternative, there no longer is a pressing need to deprecate ahead of Kubernetes.

https://docs.microsoft.com/en-us/azure/aks/use-pod-security-policies

[pierluigilenoci]

FYI https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/ and kubernetes/enhancements#2579

[ghost]

Thanks for reaching out. I'm closing this issue as it was marked with "Answer Provided" and it hasn't had activity for 2 days.

[pierluigilenoci]

FYI kubernetes/enhancements#2582