Pod Security Layers

Pod Security Layers An architecture diagram generated by Archify. Namespace Labels · enforce · audit · warn · Enforcement Methods Namespace Labels enforce · audit · warn Privileged · No restrictions · Pod Security Standards (PSS) Privileged No restrictions Baseline · Prevent privilege escalation · Pod Security Standards (PSS) Baseline Prevent privilege escalation Restricted · Strong restrictions · Pod Security Standards (PSS) Restricted Strong restrictions Security Context · securityContext · Security Context Security Context securityContext OPA Gatekeeper · Policy engine · Policy Engines OPA Gatekeeper Policy engine Kyverno · Policy engine · Policy Engines Kyverno Policy engine Admission Webhook · Admission controller · Policy Engines Admission Webhook Admission controller Privileged Pods · Privileged allowed · Pod Type Security Privileged Pods Privileged allowed Application Pods · Baseline / Restricted · Pod Type Security Application Pods Baseline / Restricted System Pods · Security context applied · Pod Type Security System Pods Security context applied set PSS level policy validation Enforcement Methods Pod Security Standards (PSS) Security Context Policy Engines Pod Type Security

Pod Security Standards (PSS)

  • • Privileged: no restrictions
  • • Baseline: prevent known privilege escalation
  • • Restricted: apply strong security restrictions
  • • Selected via namespace labels pod-security.kubernetes.io/enforce, audit, warn

Security Context

  • • runAsUser: run as a non-root user
  • • readOnlyRootFilesystem: read-only filesystem
  • • allowPrivilegeEscalation: false
  • • capabilities.drop: ALL

Policy Engine

  • • Apply cluster-wide policies with OPA Gatekeeper or Kyverno
  • • Pod creation requests are validated in the admission webhook
  • • Example: ClusterPolicy that disallows privileged containers