How deeply does Google Anthos in Action cover PodSecurityPolicy?

Explains bindings, rollout behavior, and policy limitations, but stops short of a configuration tutorial.

PodSecurityPolicy

PodSecurityPolicy is a deprecated Kubernetes API resource for enforcing security constraints on pods.

PodSecurityPolicy (PSP) is a deprecated Kubernetes API resource that enforced security constraints on deployed Pods. PSPs were intended to restrict dangerous configurations, including privileged containers and root execution. section 13.3.2

Treat PSPs as a legacy control with significant operational limitations:

Bindings depend on the Pod’s ServiceAccount or the submitting user, making policy behavior difficult to troubleshoot. section 13.3.2
PSPs cannot restrict the type of PersistentVolumeClaim, allowing a user to create a claim using HostPath. section 13.3.2
Fail-closed behavior requires every policy to exist before enabling PSPs across a cluster, preventing gradual rollout. section 13.3.2

Migration direction

Replace PSP-based security mechanisms with Gatekeeper policies; the Gatekeeper project provides policies designed specifically to replace PSPs. section 13.4.3

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

pod security admissionalternative to · Pod Security admission is a Kubernetes admission mechanism that enforces Pod security policies when resources are submitted to the API.
Gatekeeperalternative to · Gatekeeper is an open-source Kubernetes admission controller that validates and enforces policies using Open Policy Agent.
Policy Controlleralternative to · Policy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.
Kubernetescontrasts with · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.