PodSecurityPolicy Replacement: Past, Present, and Future
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 14:30· Concourse Hall 150 ABC + Online·
summary
Pod Security Admission is a built-in admission controller that replaces PSP and is alpha in 1.22 with beta targeted for 1.23 and PSP removal slated for 1.25. It enforces security via three profiles: privileged, baseline, restricted and demo blocks a privileged pod while allowing baseline and enforcing restricted (requires runAsNonRoot and dropping capabilities). It adds audit/warn/enforce, version pinning, and server-side dry-run so upgrades don’t break running pods; the demo shows these mechanisms working.
AI-written summary · about
chapters (9)
- 0:00Intro
- 2:02The Problem
- 4:20Use Cases
- 9:04PodSecurity Admission
- 11:08Demo
- 18:04PodSecurityPolicy History
- 21:13PodSecurityPolicy Future
- 25:10PodSecurityPolicy Admission
- 33:34Wrap Up
related talks
40mKubernetes Security After Pod Security Policies Removal
36mKubernetes Security After Pod Security Policies Removal
31mThe Hitchhiker's Guide to Pod Security
35mMigrating From PodSecurityPolicy
37mHandsOn PodSecurity Policies
41mUsing Pod Security Policies to harden your Kubernetes cluster
26mSecure Containers Deployments: Time for Refresh
30mPod Security as an Afterthought