How does Kubernetes Pod Security Standards (PSS) work?

Question

Accepted Answer

**Pod Security Standards** — replacement for PodSecurityPolicy (deprecated in 1.25).

**Three levels:**
- **Privileged** — no restrictions (for system Pods).
- **Baseline** — minimal restrictions (for most applications).
- **Restricted** — strict restrictions (for secure applications).

**Enable on namespace:**
```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
```

**Restricted — what is prohibited:**
```yaml
# This Pod WILL BE BLOCKED
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: app
      image: myapp
      securityContext:
        runAsRoot: true        # FORBIDDEN
        privileged: true        # FORBIDDEN
        capabilities:
          add: ["NET_ADMIN"]    # FORBIDDEN
```

**Restricted — requirements:**
```yaml
# This Pod IS ALLOWED
apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: myapp
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir: {}
```

**PSS vs PSP:** PSS is simpler, built into K8s. PSP is deprecated. Kyverno/OPA Gatekeeper — alternatives.

DevOps: How does Kubernetes Pod Security Standards (PSS) work?