Implementing Pod Security Admission Controller
Overview
Pod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.
When to Use
- Wiring PSA up on a cluster for the first time
- Setting cluster-wide default enforcement via
AdmissionConfiguration - Exempting system namespaces, service accounts, or runtime classes from enforcement
- Debugging why a pod was rejected, or why enforcement is silently not firing
- Staging a safe rollout:
warnandauditfirst,enforceonce violations reach zero - Pulling PSA violations out of the kube-apiserver audit log
Not this skill: deciding which profile a workload should run under, or what
securityContext changes Restricted demands. Use
implementing-kubernetes-pod-security-standards.
Prerequisites
- Kubernetes v1.25+ (PSA is stable/GA)
- kubectl with cluster-admin access
- No dependency on external tools - PSA is built into kube-apiserver
#…
