The Hitchhiker's Guide to Pod Security
summary
Built‑in Pod Security admission is beta in 1.23 and evaluates Pod specs against three standards — privileged, baseline, restricted — applied per namespace via labels (pod.security.kubernetes.io/mode) with enforce/warn/audit modes; it blocks pods that set allowPrivilegeEscalation true, require explicit drop of capabilities (net_bind_service example), and enforces runAsNonRoot. It does not mutate resources and replaces deprecated PodSecurityPolicy (removed by 1.25), supports version pinning, CLI dry‑run server checks, and exposes a pod_security_evaluations_total metric for monitoring.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:14Why Pod Security?
- 5:29What about Pod Security Policy?
- 12:41Enabling Pod Security
- 14:57Configuring Pod Security continued
- 28:24Next Steps
related talks
35mPodSecurityPolicy Replacement: Past, Present, and Future
36mKubernetes Security After Pod Security Policies Removal
40mKubernetes Security After Pod Security Policies Removal
35mPSP is Dead, Long Live PodSecurity
37mHandsOn PodSecurity Policies
30mPod Security as an Afterthought
33mBringing Pod Security Admission to Your Kubernetes Distribution
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring