What is Kubernetes Pod Security Standards Baseline?

Question

Accepted Answer

**Baseline** — minimally restrictive Pod security standard.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: apps
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
---
apiVersion: v1
kind: Pod
metadata:
  name: compliant-pod
  namespace: apps
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
```

```bash
kubectl apply -f pod.yaml 2>&1 | grep Warning
```

**Baseline Disallows:** privileged, hostNetwork/PID/IPC, hostPath, specific capabilities.

DevOps: What is Kubernetes Pod Security Standards Baseline?