Most of the fields in PodSecurityPolicy today cannot be implemented in Windows since they're based on Linux namespace and UID/GID assumptions.

We need a feature proposal to add or modify what can be implemented on Windows to achieve use cases such as:

• Restricting host path mounts (allowedFlexVolumes, allowedHostPaths)
• Restricting runAsUser based on username[string] or group membership rather than uid/gid
• Using group managed service accounts (related to Feature: Add Group Managed Service Account support to Windows #62038)

Areas that need to be documented as does not apply to Windows:

• hostPID, hostIPC, hostNetwork, hostPorts - these are not possible today without changes to Windows itself, could be considered for future
• fsGroup
• *Capabilities, seLinux, AppArmor, sysctl - these are all Linux specific

Is this a BUG REPORT or FEATURE REQUEST?:

/kind feature

Environment:

• Kubernetes version (use kubectl version): v1.9, v1.10, v1.11
• Cloud provider or hardware configuration: not specific
• OS (e.g. from /etc/os-release): Windows Server 2016, Windows Server version 1709, Windows Server version 1803