Pod 安全策略拒绝

**症状：**
```
Error creating: pods "xxx" is forbidden: unable to validate against any pod security policy
```

**解决：**
```bash
# 检查 PSP（K8s < 1.25）或 PSA（K8s >= 1.25）
kubectl get psp

# 为 ServiceAccount 授权
kubectl create clusterrolebinding <name> \
 --clusterrole=psp:privileged \
 --serviceaccount=<namespace>:<sa-name>