Implementing Kubernetes Pod Security Standards
Overview
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.
When to Use
- Deciding whether a namespace or workload belongs at Privileged, Baseline, or Restricted
- Auditing which existing workloads would be rejected if Restricted were enforced today
- Translating a "must meet Restricted" requirement into concrete
securityContextchanges - Planning a PodSecurityPolicy migration and predicting what will break before it does
- Mapping pod security posture to a compliance control (NIST PR.PS-01, CIS Kubernetes)
Not this skill: configuring the controller that enforces these profiles — namespace
labels, AdmissionConfiguration, exemptions, or debugging a pod PSA rejected. Use
implementing-pod-security-admission-controller.
Prerequisites
- Kubernetes cluster 1.25+ (PSA GA)
- kubectl configured with cluster-admin access
- Understanding of Linu…
