domains / families / security / implementing-pod-security-admission-controller

implementing-pod-security-admission-controller

separate

Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: namespace enforce/audit/warn labels, cluster-wide defaults via AdmissionConfiguration, exemptions for usernames, runtime classes and namespaces, version pinning, and troubleshooting pods the controller rejected. Use when wiring PSA up on a cluster, setting cluster-wide default enforcement, exempting system namespaces, debugging why a pod was rejected or why enforcement is not firing, or reading PSA audit and warning output. Keywords: Pod Security Admission, PSA, admission controller, AdmissionConfiguration, pod-security.kubernetes.io labels, enforce audit warn, exemptions, kube-apiserver. Do not use for choosing which security profile a workload needs - use implementing-kubernetes-pod-security-standards.

When to use

• Wiring PSA up on a cluster for the first time
• Setting cluster-wide default enforcement via `AdmissionConfiguration`
• Exempting system namespaces, service accounts, or runtime classes from enforcement
• Debugging why a pod was rejected, or why enforcement is silently not firing
• Staging a safe rollout: `warn` and `audit` first, `enforce` once violations reach zero
• Pulling PSA violations out of the kube-apiserver audit log

When not to use

• Choosing which security profile a workload needs
• Determining securityContext changes for Restricted profile

Skill page

Source