implementing-pod-security-admission-controller

name	implementing-pod-security-admission-controller
description	Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller. Use when implementing kubernetes pod security admission to enforce baseline and restricted.
domain	cybersecurity
subdomain	container-security
tags	["kubernetes","pod-security-admission","psa","pod-security-standards","admission-controller"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Implementing Pod Security Admission Controller

Overview

Pod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.

When to Use

Trigger phrases:

• "implementing pod security admission controller"

• "Implement Kubernetes Pod Security Admission to enforce baseline and restricted s"

• When deploying or configuring implementing pod security admission controller capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Kubernetes v1.25+ (PSA is stable/GA)
• kubectl with cluster-admin access
• No dependency on external tools - PSA is built into kube-apiserver

Pod Security Standards

This section covers pod security standards for implementing pod security admission controller.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Privileged Profile

• Unrestricted - No restrictions applied
• Use case: System-level pods (kube-system, monitoring)

Baseline Profile

• Minimally restrictive - Prevents known privilege escalation
• Blocks: privileged containers, hostPID, hostIPC, hostNetwork, hostPorts, certain volume types, adding capabilities beyond runtime defaults

Restricted Profile

• Heavily restricted - Follows security best practices
• Requires: non-root, drop ALL capabilities, seccomp RuntimeDefault, read-only root filesystem considerations
• Blocks: Everything in Baseline plus running as root, privilege escalation, non-approved volume types

Enforcement Modes

Mode	Behavior	Use Case
enforce	Reject pods violating policy