Pod Security Standards Pod Security Admissions

In this lesson, we’ll dive into Pod Security Admission (PSA) and Pod Security Standards (PSS). Introduced via KEP 2579, PSA replaces Pod Security Policies (PSP) with a safer, simpler, and extensible solution. For advanced checks, you can integrate external tools like OPA Gatekeeper.

The image lists the "Pod Security Requirements" for Kubernetes, including points like validation, safety in clusters, built-in controller, Windows support, API responsiveness, ease of use, and extensibility. It also references KEP 2579 for PSP replacement.

Pod Security Admission Overview

PSA is an Admission Controller enabled by default in Kubernetes.
Verify it by inspecting the API server’s enabled plugins:

kubectl exec -n kube-system kube-apiserver-controlplane -it -- \
  kube-apiserver -h | grep enable-admission-plugins

You should see PodSecurity listed.

Configure PSA at the namespace level by adding labels:

kubectl label namespace <NAMESPACE> pod-security.kubernetes.io/<mode>=<profile>

Note

PSA modes (enforce, audit, warn) and profiles (privileged, baseline, restricted) can be combined to meet your security requirements.

Pod Security Standards: Built-in Profiles

PSA offers three out-of-the-box profiles:

Profile	Description	Use Case
privileged	Unrestricted; allows all capabilities	Debugging, system-level tooling
baseline	Minimal restrictions; prevents privilege escalation	Most standard applications
restricted	Strict hardening; follows best practices	High-security or compliance needs

The image is a slide titled "Configure PSA" showing tables that describe modes and profiles for security standards, including actions on violation and policy descriptions.

Pod Security Admission Modes

A mode controls PSA’s response to policy violations:

Mode	Action on Violation
enforce	Rejects non-compliant pod creation requests
audit	Logs an audit event; allows the pod
warn	Emits a user-facing warning; allows the pod

You can combine modes and profiles, for example:

warn+restricted — pods are allowed, violations generate warnings
enforce+restricted — non-compliant pods are blocked

Profile Details

Baseline Profile

Designed for ease of adoption, the baseline profile prevents unauthorized privilege escalation while maintaining compatibility.

Restricted Profile

Enforces the latest pod-hardening best practices. Be aware that compatibility issues may arise.

Warning

The restricted profile may require you to update container images or init scripts to comply with stricter defaults.

Privileged Profile

Applies no restrictions; all capabilities are allowed. Use with caution.

Applying Profiles to Namespaces

Label your namespaces to enforce specific profiles and modes:

kubectl label namespace payroll pod-security.kubernetes.io/enforce=restricted
kubectl label namespace hr      pod-security.kubernetes.io/enforce=baseline
kubectl label namespace dev     pod-security.kubernetes.io/warn=restricted

In payroll: any pod violating the restricted policy is rejected.
In hr: only pods meeting the baseline policy are allowed.
In dev: all pods are created, but restricted violations generate warnings.

References

Watch Video

Watch video content