What is Kubernetes Pod Security Standards Audit?

Question

Accepted Answer

**Audit Mode** — log policy violations without blocking.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
# Non-compliant Pod (will be logged but allowed)
apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  namespace: production
spec:
  containers:
  - name: app
    image: nginx:latest
    # Missing restricted security context
```

```bash
# Check audit configuration
kubectl get namespace production -o yaml | grep pod-security

# View audit events
kubectl get events --field-selector reason=FailedCreate --sort-by=.lastTimestamp

# Check audit annotations
kubectl get pod audit-pod -o jsonpath='{.metadata.annotations}' | jq

# View warnings
kubectl apply -f audit-pod.yaml 2>&1 | grep Warning

# Check audit logs
kubectl get events -n production --sort-by=.lastTimestamp | grep -i "audit\|warn"

# Verify audit policy
kubectl get namespace production -o json | jq '.metadata.labels | to_entries[] | select(.key | contains("audit"))'
```

**Audit Behavior:**
- Logs violations to audit events.
- Doesn't block resource creation.
- Adds annotations to resources.

**Use cases:**
- Gradual policy adoption.
- Testing before enforcement.
- Compliance monitoring.

DevOps: What is Kubernetes Pod Security Standards Audit?