What is Kubernetes Pod Security Standards Exemptions?

Question

Accepted Answer

**Exemptions** — exclude specific resources from policy enforcement.

```yaml
# Namespace with exemptions
apiVersion: v1
kind: Namespace
metadata:
  name: kube-system
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
# Pod with exemption annotation
apiVersion: v1
kind: Pod
metadata:
  name: exempt-pod
  namespace: production
  annotations:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      privileged: true  # Would be rejected without exemption
```

```bash
# Check namespace policy
kubectl get namespace kube-system -o yaml | grep pod-security

# Check Pod annotations
kubectl get pod exempt-pod -o jsonpath='{.metadata.annotations}' | jq

# Verify exemption
kubectl apply -f exempt-pod.yaml  # Should succeed

# View exemption events
kubectl get events --field-selector involvedObject.name=exempt-pod

# Check system namespaces
kubectl get namespaces -o json | jq '.items[] | select(.metadata.labels["pod-security.kubernetes.io/enforce"] == "privileged") | .metadata.name'
```

**Exemption Types:**
- Namespace labels: exempt entire namespaces.
- Pod annotations: exempt specific Pods.
- User groups: exempt specific users.

**Use cases:**
- System components (kube-system).
- Legacy applications.
- Development environments.

DevOps: What is Kubernetes Pod Security Standards Exemptions?