Pod Security Standards and Pod Security Admission

Pod Security Standards and Pod Security Admission An architecture diagram generated by Archify. Namespace · pod-security.kubernetes.io/<mode> · Architecture component Namespace pod-security.kubernetes.io/<mode> Pod Security Admission · applies standards via labels · Pod Security Admission Pod Security Admission applies standards via labels enforce · blocks creation on violation · Pod Security Admission enforce blocks creation on violation audit · records violation in audit log · Pod Security Admission audit records violation in audit log warn · shows warning on violation · Pod Security Admission warn shows warning on violation Pod Security Standards · defines three policy levels · Pod Security Standards Pod Security Standards defines three policy levels Privileged · no restrictions, all permissions · Pod Security Standards Privileged no restrictions, all permissions Baseline · blocks known escalation paths · Pod Security Standards Baseline blocks known escalation paths Restricted · strongly hardened policy · Pod Security Standards Restricted strongly hardened policy Pod Creation Request · Architecture component Pod Creation Request Allow · Architecture component Allow Deny · Architecture component Deny sets label mode references level validates compliant violation (enforce) Pod Security Admission Pod Security Standards Legend Verdict Request Level Mode NS label

From PSP to PSS/PSA

  • • PodSecurityPolicy (PSP) was deprecated in Kubernetes 1.21 and completely removed in 1.25
  • • Pod Security Standards and Pod Security Admission were introduced instead

Namespace label example

  • • pod-security.kubernetes.io/enforce: restricted
  • • pod-security.kubernetes.io/audit: restricted
  • • pod-security.kubernetes.io/warn: restricted
  • • The label value selects the policy level applied in that mode