What is Kubernetes Pod Security Baseline Profile?

Question

Accepted Answer

**Baseline Profile** — minimally restrictive pod security standard.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/warn-version: latest
---
# Compliant Pod (baseline)
apiVersion: v1
kind: Pod
metadata:
  name: compliant-pod
  namespace: baseline-ns
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false  # Required by baseline
---
# Rejected Pod (baseline)
apiVersion: v1
kind: Pod
metadata:
  name: rejected-pod
  namespace: baseline-ns
spec:
  hostNetwork: true  # Rejected by baseline
  containers:
  - name: app
    image: nginx:latest
```

```bash
# Commands
kubectl get namespace baseline-ns -o yaml | grep pod-security

# Test baseline compliance
kubectl apply -f compliant-pod.yaml  # Should succeed
kubectl apply -f rejected-pod.yaml   # Should fail

# View violations
kubectl apply -f rejected-pod.yaml 2>&1 | grep Warning

# Check audit events
kubectl get events --field-selector reason=FailedCreate
```

**Baseline Disallows:**
- Host network, PID, IPC.
- Privileged containers.
- Specific Linux capabilities.
- HostPath volumes.
- HostPort.
- AppArmor seccomp profile.

**Use cases:**
- Most production workloads.
- Non-sensitive applications.
- Migration from PodSecurityPolicy.

DevOps: What is Kubernetes Pod Security Baseline Profile?