liveBook · Manning

Pod Security Standards

As explained in Kubernetes for Developers

A restricted Pod security profile is a Kubernetes security configuration that applies the strictest restrictions to Pod execution and container privileges.

When a Pod requests unsafe privileges, Kubernetes can reject it before creation. Pod Security Standards provide namespace-level profiles that control how Pods and containers may run through Pod Security admission. section 12.5.1

Choose the profile according to the workload’s security and compatibility needs:

  • Privileged permits unrestricted administrative access and can allow root access to cluster nodes; reserve it for system or administrative workloads. section 12.5.1 section 12.5.2
  • Baseline prevents privilege elevation while preserving broader application compatibility; it is suggested for ordinary nonadministrative workloads. section 12.5.1 section 12.5.2
  • Restricted applies defense-in-depth best practices, including requiring containers to run as non-root, but may require application changes. section 12.5.1 section 12.5.2

Enforcing the restricted profile

Label a namespace with pod-security.kubernetes.io/enforce: restricted and pod-security.kubernetes.io/enforce-version: v1.28. A compliant container sets runAsNonRoot: true, allowPrivilegeEscalation: false, runAsUser: 1001, capabilities.drop: [ALL], and a RuntimeDefault seccomp profile. Kubernetes then creates the Pod; otherwise admission reports the violated requirements. section 12.5.1 section 12.5.1

Listing 12.11 Chapter12/12.5_PodSecurityAdmission/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
 name: team1
 labels:
   pod-security.kubernetes.io/enforce: restricted
   pod-security.kubernetes.io/enforce-version: v1.28

Browse the namespace manifest that enables restricted enforcement and pins the policy definition to v1.28. section 12.5.1

Failures can also appear indirectly: a Deployment may exist while its ReplicaSet creates no Pods because admission rejects each attempted Pod. Inspect controller events for the exact missing security settings. section 12.5.1

How Kubernetes for Developers covers it

How deep it goes
Defines three profiles and demonstrates restricted enforcement, required security contexts, and admission failures.
Examples
Uses a team namespace, restricted-policy labels, a compliant non-root Pod, and rejected Pod and Deployment attempts.
What it assumes
Assumes basic Kubernetes namespaces and Pods while teaching security profiles, admission enforcement, and non-root configuration.
What you can do after
Operate/configure namespaces with Pod Security admission and diagnose rejected Pods using security-context requirements and controller events.
How it connects
Connects Pod Security admission with admission controllers, namespaces, security contexts, non-root containers, and Deployments.
Cover of Kubernetes for Developers
liveBookmanning.com
Read Kubernetes for Developers on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Kubernetes for Developers. The section links point to the parts of the book it draws on.