What is Kubernetes Pod Security Privileged Profile?

Question

Accepted Answer

**Privileged Profile** — unrestricted pod security (system namespaces).

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: kube-system
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
# Privileged Pod (kube-system)
apiVersion: v1
kind: Pod
metadata:
  name: system-pod
  namespace: kube-system
spec:
  hostNetwork: true
  hostPID: true
  hostIPC: true
  containers:
  - name: kube-proxy
    image: kube-proxy:latest
    securityContext:
      privileged: true
    volumeMounts:
    - name: kube-proxy-config
      mountPath: /var/lib/kube-proxy
    - name: xtables-lock
      mountPath: /run/xtables.lock
  volumes:
  - name: kube-proxy-config
    hostPath:
      path: /var/lib/kube-proxy
  - name: xtables-lock
    hostPath:
      path: /run/xtables.lock
      type: FileOrCreate
```

```bash
# Commands
kubectl get namespace kube-system -o yaml | grep pod-security

# Check privileged Pods
kubectl get pods -n kube-system -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged == true) | .metadata.name'

# Verify host access
kubectl get pods -n kube-system -o json | jq '.items[] | {name: .metadata.name, hostNetwork: .spec.hostNetwork, hostPID: .spec.hostPID}'

# Check system namespaces
kubectl get namespaces -o json | jq '.items[] | select(.metadata.labels["pod-security.kubernetes.io/enforce"] == "privileged") | .metadata.name'
```

**Privileged Allows:**
- Host network, PID, IPC.
- Privileged containers.
- All capabilities.
- HostPath volumes.
- Any seccomp profile.

**Use cases:**
- System components (kube-system).
- CNI plugins.
- Storage drivers.
- Monitoring agents.

DevOps: What is Kubernetes Pod Security Privileged Profile?