What is Kubernetes Pod Security Restricted Profile?

Question

Accepted Answer

**Restricted Profile** — heavily restricted pod security standard.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
---
# Compliant Pod (restricted)
apiVersion: v1
kind: Pod
metadata:
  name: restricted-pod
  namespace: restricted-ns
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}
```

```bash
# Commands
kubectl get namespace restricted-ns -o yaml | grep pod-security

# Test restricted compliance
kubectl apply -f restricted-pod.yaml  # Should succeed

# View violations
kubectl apply -f non-compliant-pod.yaml 2>&1

# Check Pod security context
kubectl get pod restricted-pod -o jsonpath='{.spec.securityContext}' | jq
kubectl get pod restricted-pod -o jsonpath='{.spec.containers[0].securityContext}' | jq

# Verify non-root
kubectl exec restricted-pod -- id
kubectl exec restricted-pod -- whoami

# Check seccomp profile
kubectl exec restricted-pod -- cat /proc/1/status | grep Seccomp
```

**Restricted Disallows:**
- All baseline restrictions.
- Running as root.
- Privilege escalation.
- Specific capabilities.
- HostPath volumes.

**Required:**
- runAsNonRoot: true.
- drop ALL capabilities.
- seccompProfile: RuntimeDefault or Localhost.

DevOps: What is Kubernetes Pod Security Restricted Profile?