PSP → PSS Migration Path

PSP → PSS Migration Path A workflow diagram generated by Archify. 01 / Prepare · analyze and validate 02 / Gradual rollout 03 / Switch to enforce 04 / PSP cleanup 1. Analyze Current State · Review archived/current policies · Prepare · analyze and validate 1. Analyze Current State Review archived/current policies 2. Map to PSS Profiles · Gap analysis, not equivalence · Prepare · analyze and validate 2. Map to PSS Profiles Gap analysis, not equivalence 3. Validate in Test Environment · pss-test namespace, warn mode · Prepare · analyze and validate 3. Validate in Test Environment pss-test namespace, warn mode 4. Apply with warn/audit Mode · enforce unchanged, monitor only · Gradual rollout 4. Apply with warn/audit Mode enforce unchanged, monitor only 5. Modify Workloads · harden securityContext · Gradual rollout 5. Modify Workloads harden securityContext 6. Switch to enforce Mode · enforce: restricted, blocking · Switch to enforce 6. Switch to enforce Mode enforce: restricted, blocking 7. Retire legacy configuration · PSP API only on <=1.24 · PSP cleanup 7. Retire legacy configuration PSP API only on <=1.24 Legend Analysis / remediation work PSS mode application

Mapping limits

  • • A few PSP fields do not establish PSS equivalence
  • • Check seccomp, SELinux, capabilities, OS and user namespaces
  • • Review PSP mutation and identity-dependent rules separately

Step 4 Gradual Rollout Order

  • • Preserve the existing enforce level
  • • Add warn/audit to assess violations
  • • Move to a tested, approved target policy version

Restricted-Compliant Workload Fixes

  • • Linux/default-user-namespace examples; verify versioned rules
  • • runAsNonRoot / seccomp / no privilege escalation / drop ALL
  • • readOnlyRootFilesystem is additional hardening, not PSS-required