What is Kubernetes Pod Security Standards Enforcement?

Question

Accepted Answer

**Enforcement** — reject non-compliant Pods at admission.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
---
apiVersion: v1
kind: Pod
metadata:
  name: compliant-pod
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
```

```bash
kubectl apply -f non-compliant.yaml 2>&1 | grep Warning
kubectl get events -n production --field-selector reason=FailedCreate
```

**Modes:** enforce (reject), audit (log), warn (show).

DevOps: What is Kubernetes Pod Security Standards Enforcement?