| name | implementing-kubernetes-pod-security-standards |
| description | Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS. Use when working with implementing kubernetes pod security standards. |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["containers","kubernetes","security","pod-security","PSA"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
Implementing Kubernetes Pod Security Standards
Overview
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.
When to Use
Trigger phrases:
-
"implementing kubernetes pod security standards"
-
"Pod Security Standards (PSS) define three levels of security policies -- Privile"
-
When deploying or configuring implementing kubernetes pod security standards capabilities in your environment
-
When establishing security controls aligned to compliance requirements
-
When building or improving security architecture for this domain
-
When conducting security assessments that require this implementation
Prerequisites
- Kubernetes cluster 1.25+ (PSA GA)
- kubectl configured with cluster-admin access
- Understanding of Linux capabilities and security contexts
Core Concepts
This section covers core concepts for implementing kubernetes pod security standards.
- Ensure all prerequisites are met before proceeding
- Follow the documented workflow steps in sequence
- Record results and any anomalies encountered during this phase
Three Security Profiles
| Profile | Purpose | Restrictions |
|---|
| Privileged | Unrestricted, system workloads | None |
| Baseline | Prevents known escalations | No hostNetwork, hostPID, hostIPC, privileged containers, dangerous capabilities |
| Restricted | Hardened best practices | Non-root, drop ALL caps, seccomp required, read-only rootfs recommended |
Three Enforcement Modes
| Mode | Behavior |
|---|
| enforce | Rejects pods that violate the policy |
| audit | Logs violations in audit log but allows pod |
|
