What is Kubernetes Pod Security Standards Restricted?

Question

Accepted Answer

**Restricted** — heavily restricted Pod security standard.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
---
apiVersion: v1
kind: Pod
metadata:
  name: restricted-pod
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}
```

```bash
kubectl apply -f pod.yaml 2>&1
kubectl get pod restricted-pod -o jsonpath='{.status.qosClass}'
```

**Required:** runAsNonRoot, drop ALL capabilities, seccomp RuntimeDefault.

DevOps: What is Kubernetes Pod Security Standards Restricted?