Skip to main content

Chapter 9.4 - Pod Security Standards

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand Pod Security Standards (PSS)
  • Apply security levels (Privileged, Baseline, Restricted)
  • Configure admission control
  • Understand security restrictions
  • Migrate to more secure Pods
  • Understand Pod Security Policies (deprecated)

Introduction​

Pod Security Standards (PSS) define three security levels for Pods in Kubernetes. They replace Pod Security Policies (deprecated).

Security Levels​

Privileged​

No restrictions. Allows all capabilities.

Use case: Low-level systems, debugging.

Baseline​

Minimal restrictions. Prevents the most dangerous configurations.

Recommended for: Most applications.

Restricted​

Maximum restrictions. Follows security best practices.

Recommended for: Critical applications, sensitive environments.

Namespace-Level Configuration​

Via Labels​

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Labels:

  • enforce: Applies the level (blocks non-compliant Pods)
  • audit: Records violations
  • warn: Displays a warning

Via Admission Control​

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    defaults:
      enforce: "restricted"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: ["kube-system"]

Baseline Restrictions​

Examples of Restrictions​

  • No hostPID, hostIPC, hostNetwork
  • No hostPath volumes
  • No dangerous capabilities
  • No runAsUser=0 (root)

Example: Baseline Pod​

apiVersion: v1
kind: Pod
metadata:
  name: baseline-pod
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: my-app:1.0
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL

Restricted Restrictions​

Additional Restrictions​

  • runAsNonRoot: true required
  • seccompProfile: RuntimeDefault required
  • No hostPath volumes
  • No capabilities
  • readOnlyRootFilesystem: true recommended

Example: Restricted Pod​

apiVersion: v1
kind: Pod
metadata:
  name: restricted-pod
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: my-app:1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 1000
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

Progressive Migration​

Step 1: Audit​

apiVersion: v1
kind: Namespace
metadata:
  name: my-app
  labels:
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline

Result: Violations are recorded but Pods are accepted.

Step 2: Warning​

metadata:
  labels:
    pod-security.kubernetes.io/warn: restricted

Result: Violations display warnings.

Step 3: Enforcement​

metadata:
  labels:
    pod-security.kubernetes.io/enforce: restricted

Result: Non-compliant Pods are rejected.

Useful Commands​

Verification​

# View security labels
kubectl get namespace production -o yaml | grep pod-security

# Check Pod compliance
kubectl get pod my-pod -o yaml | grep -A 10 securityContext

# Test a Pod
kubectl apply -f pod.yaml --dry-run=server

Best Practices​

1. Start with Baseline​

Start with Baseline, then migrate to Restricted.

2. Progressive Migration​

Use audit → warn → enforce for a smooth migration.

3. Exemptions​

Define exemptions for system namespaces.

4. Documentation​

Document the reasons for exemptions.

5. Monitoring​

Monitor violations to identify issues.

Summary​

In this chapter, you learned:

Pod Security Standards: Three levels (Privileged, Baseline, Restricted)
Configuration: Via namespace labels or admission control
Baseline: Minimal restrictions, recommended for most
Restricted: Maximum restrictions, best practices
Migration: Audit → Warn → Enforce
Best practices: Progressive approach, exemptions, monitoring

Next Steps​

Module 10: Helm and Package Management
Lab 9.4: Security Audit

Chapter created on: December 2024