Kubernetes Security After Pod Security Policies Removal
summary
PSP resources get deprecated in Kubernetes 1.25 so cluster operators must replace them with namespace-level pod security labels (enforce/audit/warn) — three built-in standards pod security: privileged, baseline, restricted — but those cover only pods and are non‑mutating. A drop‑in alternative is an admission webhook policy engine; the example uses keywording policy server runs WebAssembly modules which supports mutating and validating policies, OCI policy modules, a one‑line Appvia migration script, and works for any Kubernetes resource.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:25Security is a trade-off
- 1:10Cloud native security forces
- 2:12RBAC and pod creation
- 3:17Pod Security Policies overview
- 5:24Why PSPS are deprecated
- 8:13PSP alternatives
- 10:20Pod Security standards
- 12:30Pod Security modes
- 13:32Pod Security enforcement
- 16:42Migrating from PSPS
- 18:06PSP to Pod Security example
- 19:31Pod Security trade-offs
- 21:14Admission webhooks
- 23:21Creating admission webhooks
- 24:03Kyverno introduction
- 25:26Kyverno policy server
- 26:50Kyverno policy benefits
- 27:34Kyverno policy example
- 28:39Kyverno in action
- 30:05PSP migration to Kyverno
- 32:17Kyverno vs custom webhooks
- 34:07Combining solutions
related talks
40mKubernetes Security After Pod Security Policies Removal
35mMigrating From PodSecurityPolicy
41mUsing Pod Security Policies to harden your Kubernetes cluster
35mPSP is Dead, Long Live PodSecurity
37mHandsOn PodSecurity Policies
26mSecure Containers Deployments: Time for Refresh
35mPodSecurityPolicy Replacement: Past, Present, and Future
33mBringing Pod Security Admission to Your Kubernetes Distribution