What is Kubernetes Pod OS Security Policy?

Question

Accepted Answer

**Pod OS** — control operating system for Pod security.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  os:
    name: linux
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: nginx-cache
      mountPath: /var/cache/nginx
    - name: nginx-run
      mountPath: /var/run
  volumes:
  - name: tmp
    emptyDir: {}
  - name: nginx-cache
    emptyDir: {}
  - name: nginx-run
    emptyDir: {}
---
# Windows Pod security
apiVersion: v1
kind: Pod
metadata:
  name: windows-pod
spec:
  os:
    name: windows
  securityContext:
    windowsOptions:
      runAsUserName: "ContainerUser"
  containers:
  - name: app
    image: mcr.microsoft.com/dotnet/runtime:8.0
```

```bash
# Check Pod security
kubectl get pod secure-pod -o jsonpath='{.spec.securityContext}' | jq
kubectl get pod secure-pod -o jsonpath='{.spec.containers[0].securityContext}' | jq

# Verify non-root
kubectl exec secure-pod -- id
kubectl exec secure-pod -- whoami

# Check seccomp profile
kubectl get pod secure-pod -o jsonpath='{.spec.securityContext.seccompProfile}' | jq

# Check capabilities
kubectl exec secure-pod -- cat /proc/1/status | grep Cap
```

**Linux Security:**
- runAsNonRoot: prevent root execution.
- readOnlyRootFilesystem: prevent writes.
- seccompProfile: system call filtering.
- capabilities: fine-grained privileges.

**Windows Security:**
- runAsUserName: specific user.
- RunAsGroup: group assignment.

DevOps: What is Kubernetes Pod OS Security Policy?