Skip to content

Pod Security Standards

Guide

PSPs are gone. Their replacement is the Pod Security Admission (PSA) controller, built into the API server since v1.25. It enforces one of three profiles per namespace: privileged, baseline, restricted.

The three profiles

Profile	Intent	Blocks
`privileged`	Unrestricted — system components	Nothing
`baseline`	Prevent known privilege escalation	hostNetwork, hostPID, hostPath, privileged containers
`restricted`	Follow current pod-hardening best practices	Most capabilities, runAsRoot, allowPrivilegeEscalation

Three modes per profile

Enable it

apiVersion: v1
kind: Namespace
metadata:
  name: payments
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

That’s it — no controller to install, nothing to deploy.

What “restricted” actually forces

Container security context
What gets rejected

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  template:
    spec:
      containers:
        - name: api
          image: ghcr.io/reetwiz/api:1.4.2
          ports: [{ containerPort: 8080 }]
          securityContext:
            runAsNonRoot: true
            runAsUser: 10001
            runAsGroup: 10001
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
      securityContext:
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault

kubectl apply -f bad-pod.yaml
# Error from server (Forbidden): error when creating "bad-pod.yaml":
# pods "root-shell" is forbidden: violates PodSecurity "restricted:latest":
#   allowPrivilegeEscalation != false (container "shell" must set ...),
#   unrestricted capabilities (container "shell" must set ...),
#   runAsNonRoot != true (pod or container "shell" must set ...),
#   seccompProfile (pod or container "shell" must set ...)

Rollout strategy

Progressive rollout:

labels:
  pod-security.kubernetes.io/enforce: baseline      # week 1: prevent obvious badness
  pod-security.kubernetes.io/warn: restricted        # week 1: warn devs of the target
  pod-security.kubernetes.io/audit: restricted       # week 1: audit-log everything
  # week 4:
  # pod-security.kubernetes.io/enforce: restricted

Further reading