Pod Security admission protects a Kubernetes cluster by checking Pods when they are submitted to the API. Instead of writing a custom admission webhook, assign a security profile to a namespace and let Kubernetes reject Pods that violate it. section 12.5.1
Pod Security Standards provide three namespace-level policy profiles:
- Privileged allows unrestricted administrative access and should generally be reserved for system workloads. section 12.5.1
- Baseline blocks privilege escalation into administrative access while preserving more compatibility. section 12.5.1
- Restricted adds defense-in-depth requirements, including running containers as non-root, at the cost of compatibility. section 12.5.1
Listing 12.11 Chapter12/12.5_PodSecurityAdmission/namespace.yaml
apiVersion: v1 kind: Namespace metadata: name: team1 labels: pod-security.kubernetes.io/enforce: restricted pod-security.kubernetes.io/enforce-version: v1.28
Configure a namespace by labeling it with the enforced profile and the profile version; this example applies Restricted v1.28 to team1. section 12.5.1
A Restricted namespace can reject an ordinary Pod before creation, reporting missing settings such as allowPrivilegeEscalation=false, dropping all capabilities, and runAsNonRoot=true. Add those settings to the Pod or container security context, plus a RuntimeDefault seccomp profile, and the Pod can be created. The same enforcement applies when a Deployment later creates Pods. section 12.5.1 section 12.8
