Pod Security Standards

From PSP to Standards

PodSecurityPolicy was removed in Kubernetes 1.25; its replacement is the Pod Security Standards — three built-in profiles applied per namespace through labels:

• privileged — unrestricted; explicit opt-in for trusted system workloads.
• baseline — blocks known escalations: no hostNetwork/hostPID/hostIPC, no hostPaths, no privileged containers, no capability additions beyond NET_BIND_SERVICE.
• restricted — current best practice: runAsNonRoot, allowPrivilegeEscalation: false, seccomp RuntimeDefault, all capabilities dropped.

kubectl label ns prod \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest

Enforcement happens at admission: a violating pod submission is rejected with a message naming the failed control.

Enforce, Audit, and Warn

Each level gets three independent labels:

• pod-security.kubernetes.io/enforce — reject violations.
• pod-security.kubernetes.io/audit — allow, but log violations.
• pod-security.kubernetes.io/warn — show warnings to whoever submits.

A safe migration runs warn + audit at restricted while enforce stays at baseline, then flips enforce once workloads comply. The -version labels pin the standard applied (for example v1.29) so a cluster upgrade cannot silently tighten rules on you.

Pods satisfy restricted with a matching securityContext:

securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  seccompProfile: { type: RuntimeDefault }
  capabilities: { drop: ["ALL"] }
  allowPrivilegeEscalation: false

Anything beyond the built-in profiles requires admission webhooks — the standards are deliberately fixed.

Pitfalls and Interview Angles

Pitfall 1 — enforcing on legacy namespaces. Running pods are not deleted retroactively, but every reschedule or new deploy starts failing admission. Roll out warn and audit first and burn down the findings.

Pitfall 2 — images that require root. An image built with USER root or an entrypoint assuming uid 0 breaks under restricted; fix the Dockerfile instead of weakening the namespace policy.

Interview-ready: name the three profiles with one control each, distinguish enforce from audit and warn, explain why PSP was replaced (static, cluster-awkward admission policy with poor expressiveness), and point to OPA/Gatekeeper or Kyverno for custom rules beyond the standards.