Bringing Pod Security Admission to Your Kubernetes Distribution
summary
Brings Pod Security Admission into a Kubernetes distribution by committing a clusterwide PSA config, building a controller that maps legacy SCC/ARB to namespace labels using server-side apply, and extracting violations from audit logs with CI runs and jq. Adds Prometheus alerts and limited telemetry, discovers tens of repos to fix and a Prometheus cardinality risk, and stages enforcement via versioned enforce/audit/warn modes. Initial rollout shows roughly 40% of upgraded clusters reporting violations, then drops as fixes land.
AI-written summary · about
chapters (20)
- 0:00Pod Security Admission intro
- 1:03What is PSA
- 2:08Pod Security Profiles
- 4:38Pod Security Admission Modes
- 6:05Evaluating cluster security
- 7:10Audit logs for violations
- 9:00Syncing labels with policies
- 11:47Communicating changes
- 14:21Fixing violations
- 15:24Alerts for violations
- 17:33Monitoring workloads
- 20:50Validating platform workloads
- 21:35Adding PSA labels to tests
- 23:22Waiting for upgrades
- 24:46Post-upgrade violations
- 25:49Customer support
- 26:50Global security profiles
- 27:13Acknowledgments
- 29:05Q&A: SCC integration
- 31:36Q&A: PSA in nested clusters
related talks
35mPSP is Dead, Long Live PodSecurity
36mKubernetes Security After Pod Security Policies Removal
40mKubernetes Security After Pod Security Policies Removal
35mMigrating From PodSecurityPolicy
26mSecure Containers Deployments: Time for Refresh
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
37mHandsOn PodSecurity Policies
24mOne stop talk for kubernetes security !!