What is Kubernetes Pod Security Admission?

Question

Accepted Answer

**Pod Security Admission** — enforce pod security standards at namespace level.

```yaml
# Namespace labels for Pod Security Standards
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
# Compliant Pod
apiVersion: v1
kind: Pod
metadata:
  name: compliant-pod
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /var/cache/nginx
  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}
```

```bash
# Check namespace enforcement
kubectl get namespace production -o yaml | grep pod-security

# Test policy (will be rejected)
kubectl run test --image=nginx --namespace=production --privileged

# View warnings
kubectl apply -f pod.yaml 2>&1 | grep Warning

# Bypass for system namespaces
kubectl label namespace kube-system pod-security.kubernetes.io/enforce=privileged
```

**Standards:**
- privileged: unrestricted.
- baseline: minimally restrictive.
- restricted: heavily restricted.

**Modes:**
- enforce: reject non-compliant Pods.
- audit: log violations.
- warn: show warnings.

DevOps: What is Kubernetes Pod Security Admission?