domains / families / security / implementing-kubernetes-pod-security-standards

implementing-kubernetes-pod-security-standards

separate

Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: what each profile forbids, how to map existing workloads to a profile, which securityContext fields must change, and how to plan a PodSecurityPolicy-to-PSS migration without breaking running pods. Use when deciding which pod security profile a namespace or workload should run under, auditing which workloads would fail Restricted, planning a PSP migration, or mapping pod security posture to a compliance control. Keywords: Pod Security Standards, PSS, Privileged, Baseline, Restricted, securityContext, runAsNonRoot, drop ALL capabilities, seccomp RuntimeDefault, PSP migration. Do not use for configuring the admission controller that enforces these profiles - use implementing-pod-security-admission-controller.

When to use

• Deciding whether a namespace or workload belongs at Privileged, Baseline, or Restricted
• Auditing which existing workloads would be rejected if Restricted were enforced today
• Translating a "must meet Restricted" requirement into concrete `securityContext` changes
• Planning a PodSecurityPolicy migration and predicting what will break before it does
• Mapping pod security posture to a compliance control (NIST PR.PS-01, CIS Kubernetes)

When not to use

• Configuring the admission controller that enforces these profiles
• Configuring namespace labels for the controller
• Configuring AdmissionConfiguration
• Configuring exemptions
• Debugging a pod PSA rejected

Skill page

Source