Pod Security Standards and Admission

Pod Security Standards define three levels. Pod Security Admission (built in) enforces them per namespace with labels.

Level	Allows	For
privileged	everything	system namespaces, CNI, storage drivers
baseline	no privileged, no host namespaces, no hostPath, no dangerous capabilities	most legacy apps
restricted	baseline + non-root, drop ALL, no privilege escalation, seccomp	new apps - the target

Mode	Effect
`enforce`	violating Pods are rejected
`audit`	allowed, recorded in the audit log
`warn`	allowed, the user sees a warning

apiVersion: v1
kind: Namespace
metadata:
  name: shop
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

The typical rollout: warn/audit restricted, enforce baseline - then fix the warnings and raise enforce.

# what would break if I enforced restricted here?
kubectl label --dry-run=server --overwrite ns shop \
  pod-security.kubernetes.io/enforce=restricted

Warning

PSA checks Pods. A Deployment with a violating template is accepted - its ReplicaSet then fails to create Pods (FailedCreate). Look at the ReplicaSet events, or use warn which also checks workload templates.

Pod Security Standards and Admission

Pod Security Standards and Admission

References