What is Kubernetes Pod Security Standards Enforcement?

Question

Accepted Answer

**Enforcement** — reject non-compliant Pods at admission.

```yaml
# Enforce restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
# Non-compliant Pod (will be rejected)
apiVersion: v1
kind: Pod
metadata:
  name: non-compliant
  namespace: production
spec:
  containers:
  - name: app
    image: nginx:latest
    # Missing required security context
---
# Compliant Pod
apiVersion: v1
kind: Pod
metadata:
  name: compliant
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}
```

```bash
# Check namespace enforcement
kubectl get namespace production -o yaml | grep pod-security

# Test enforcement
kubectl apply -f non-compliant.yaml  # Should fail
kubectl apply -f compliant.yaml  # Should succeed

# View violations
kubectl apply -f non-compliant.yaml 2>&1 | grep Warning

# Check audit events
kubectl get events --field-selector reason=FailedCreate --sort-by=.lastTimestamp

# Bypass for system namespaces
kubectl label namespace kube-system pod-security.kubernetes.io/enforce=privileged
```

**Enforcement Levels:**
- privileged: no restrictions.
- baseline: minimal restrictions.
- restricted: heavy restrictions.

**Modes:**
- enforce: reject non-compliant.
- audit: log violations.
- warn: show warnings.

DevOps: What is Kubernetes Pod Security Standards Enforcement?