PSA checks during Pod CREATE

PSA checks during Pod CREATE A sequence diagram generated by Archify. Pod creation request Internal policy evaluation Check namespace labels enforce=restricted, audit=restricted PSA check passed Store Pod Assumes other admission checks also succeeded 201 Created 201 only after successful persistence Denied (enforce mode) 403 Forbidden Admission validation Pod complies with policy Pod violates policy (enforce mode) User/Controller · Pod CREATE · Sequence participant User/Controller Pod CREATE API Server · kube-apiserver · Sequence participant API Server kube-apiserver PSA internal step · Inside kube-apiserver · Sequence participant PSA internal step Inside kube-apiserver Namespace Labels · pod-security.kubernetes.io/* · Sequence participant Namespace Labels pod-security.kubernetes.io/* etcd · cluster state store · Sequence participant etcd cluster state store Legend request return security default message

Diagram assumptions

  • • Pod CREATE, not Deployment admission
  • • Assumes authentication, authorization and other checks pass
  • • PSA runs inside kube-apiserver