What is Kubernetes Pod Security Standards Warn?

Question

Accepted Answer

**Warn Mode** — show warnings for policy violations.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
---
# Non-compliant Pod (will show warning)
apiVersion: v1
kind: Pod
metadata:
  name: warn-pod
  namespace: production
spec:
  containers:
  - name: app
    image: nginx:latest
    # Missing restricted security context
```

```bash
# Check warn configuration
kubectl get namespace production -o yaml | grep pod-security

# View warnings
kubectl apply -f warn-pod.yaml 2>&1 | grep Warning

# Check warning annotations
kubectl get pod warn-pod -o jsonpath='{.metadata.annotations}' | jq

# View warning events
kubectl get events -n production --sort-by=.lastTimestamp | grep -i warn

# Verify warn policy
kubectl get namespace production -o json | jq '.metadata.labels | to_entries[] | select(.key | contains("warn"))'

# Test warn behavior
kubectl apply -f warn-pod.yaml 2>&1
```

**Warn Behavior:**
- Shows warnings in kubectl output.
- Doesn't block resource creation.
- Logs to audit events.

**Use cases:**
- Gradual policy adoption.
- Developer feedback.
- Compliance monitoring.

DevOps: What is Kubernetes Pod Security Standards Warn?