I have a K8S cluster running in Azure AKS service.

I want to enforce MustRunAsNonRoot policy. How to do it?

The following policy is created:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restrict-root
spec:
  privileged: false
  allowPrivilegeEscalation: false
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'

It is deployed in the cluster:

$ kubectl get psp
NAME                            PRIV    CAPS   SELINUX    RUNASUSER          FSGROUP     SUPGROUP    READONLYROOTFS   VOLUMES
restrict-root                   false          RunAsAny   MustRunAsNonRoot   RunAsAny    RunAsAny    false            *

Admission controller is running in the cluster:

$ kubectl get pods -n gatekeeper-system
NAME                                     READY   STATUS    RESTARTS   AGE
gatekeeper-audit-7b4bc6f977-lvvfl        1/1     Running   0          32d
gatekeeper-controller-5948ddcd54-5mgsm   1/1     Running   0          32d
gatekeeper-controller-5948ddcd54-b59wg   1/1     Running   0          32d

Anyway it is possible to run a simple pod running under root:

apiVersion: v1
kind: Pod
metadata:
  name:      mypod
spec:
  containers:
    - name:  mypod
      image: busybox
      args: ["sleep", "10000"]
      securityContext:
        runAsUser: 0

Pod is running:

$ kubectl describe po mypod
Name:         mypod
Namespace:    default
Priority:     0
Node:         aks-default-31327534-vmss000001/10.240.0.5
Start Time:   Mon, 08 Feb 2021 23:10:46 +0100
Labels:       <none>
Annotations:  <none>
Status:       Running

Why MustRunAsNonRoot is not applied? How to enforce it?

EDIT: It looks like AKS engine does not support PodSecurityPolicy (list of supported policies). Then the question is still the same: how to enforce MustRunAsNonRoot rule on workloads?