The Restricted profile adds defense-in-depth requirements to Kubernetes Pods. It prevents containers from running as root and requires security settings that reduce privilege and capability risks. section 12.5.1
Pod Security Standards provide three namespace-level policy choices:
- Privileged permits unrestricted administrative access and should be reserved for system workloads. section 12.5.1
- Baseline blocks privilege elevation while preserving more compatibility. section 12.5.1
- Restricted applies current hardening practices, including non-root execution, at the cost of some compatibility. section 12.5.1
Enforce Restricted in a namespace
Label a namespace with pod-security.kubernetes.io/enforce: restricted and pod-security.kubernetes.io/enforce-version: v1.28. Pods in that namespace must satisfy the profile. A compliant Pod sets runAsNonRoot: true, allowPrivilegeEscalation: false, runAsUser: 1001, drops all capabilities, and uses RuntimeDefault for seccomp. Kubernetes accepts this Pod; a noncompliant Pod is rejected with a Forbidden admission error.
