Kubernetes Pod Security Standards Explained

The PodSecurityPolicy Deprecation

PodSecurityPolicy (PSP) was removed in Kubernetes 1.25. The replacement: Pod Security Standards (PSS) — built-in, no extra controllers needed.

Three Security Levels

Enable Per-Namespace

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Enforce restricted (reject violations)
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    # Warn on baseline violations (log but allow)
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted
---
apiVersion: v1
kind: Namespace
metadata:
  name: kube-system
  labels:
    # System namespace needs privileged
    pod-security.kubernetes.io/enforce: privileged

What Restricted Blocks

# ❌ This pod will be REJECTED in a restricted namespace
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: app
      image: myapp
      securityContext:
        privileged: true          # ❌ Blocked
        runAsUser: 0              # ❌ Must be non-root
        allowPrivilegeEscalation: true  # ❌ Blocked
      volumeMounts:
        - name: host
          mountPath: /host
  volumes:
    - name: host
      hostPath:                   # ❌ Blocked
        path: /

# ✅ This pod PASSES restricted
apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: myapp
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
        runAsUser: 1000

Migration from PSP

# 1. Audit what would break
kubectl label ns production pod-security.kubernetes.io/warn=restricted --dry-run=server

# 2. Check violations
kubectl get events --field-selector reason=FailedCreate -A | grep "violates PodSecurity"

# 3. Fix pods, then enforce
kubectl label ns production pod-security.kubernetes.io/enforce=restricted

Kyverno (Policy-as-Code Alternative)

For more granular control than built-in PSS:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-non-root
      match:
        resources:
          kinds: [Pod]
          namespaces: [production]
      validate:
        message: "Containers must run as non-root"
        pattern:
          spec:
            containers:
              - securityContext:
                  runAsNonRoot: true
                  allowPrivilegeEscalation: false

OPA Gatekeeper

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredSecurityContext
metadata:
  name: must-run-as-nonroot
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["production"]
  parameters:
    runAsNonRoot: true
    allowPrivilegeEscalation: false

Comparison

Recommended Strategy

1. Start with PSS — label all namespaces (baseline for dev, restricted for prod)
2. Add Kyverno — for policies PSS can’t express (image allowlists, label requirements)
3. Audit mode first — warn before enforce
4. Exempt system namespaces — kube-system, monitoring, cert-manager need privileged

Related Articles

• Kubernetes RBAC
• Falco: Runtime Security
• Network Policies: Zero Trust