Implementing Pod Security Admission
1. Understanding Pod Security Standards
| Profile | Description |
|---|
| privileged | Unrestricted |
| baseline | Blocks known privilege escalations |
| restricted | Hardened best-practice (runAsNonRoot, drop ALL caps, seccomp RuntimeDefault) |
2. Using Pod Security Admission
Note: PSA is built-in since 1.25 (replaced PodSecurityPolicy). Enforced per namespace via labels.
3. Configuring Namespace Labels
kubectl label ns prod \
pod-security.kubernetes.io/enforce=restricted \
pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/warn=restricted
4. Setting Enforce Level
| Label | Behavior |
|---|
| enforce | Reject non-compliant pods |
| audit | Allow but log to audit |
| warn | Allow but return warning to user |
5. Setting Audit Level
kubectl label ns dev pod-security.kubernetes.io/audit=baseline
6. Setting Warn Level
kubectl label ns dev pod-security.kubernetes.io/warn=restricted
7. Controlling Host Namespaces
| Field | baseline | restricted |
|---|
| hostNetwork | Forbidden | Forbidden |
| hostPID | Forbidden | Forbidden |
| hostIPC | Forbidden | Forbidden |
8. Restricting Volume Types
| baseline blocks | restricted allows |
|---|
| hostPath | configMap, secret, downwardAPI, projected, emptyDir, PVC, CSI ephemeral |
9. Configuring Allowed Capabilities
| Profile | Allowed |
|---|
| baseline | Default container caps (AUDIT_WRITE, CHOWN, ...) |
| restricted | Only NET_BIND_SERVICE; must drop ALL |
10. Migrating from PodSecurityPolicy
| PSP Concept | PSA Equivalent |
|---|
| runAsNonRoot | restricted profile |
| volumes allowlist | restricted/baseline rules |
| RBAC binding | Namespace labels |
| Mutation | Not supported — use Kyverno/Gatekeeper |
Note: PodSecurityPolicy removed in 1.25 DEPRECATED.