What is Kubernetes Pod Security Standards Testing?

Question

Accepted Answer

**Testing** — validate Pod compliance with security standards.

```yaml
# Test Pod (restricted compliant)
apiVersion: v1
kind: Pod
metadata:
  name: test-restricted
  namespace: test-ns
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}
---
# Non-compliant Pod (baseline)
apiVersion: v1
kind: Pod
metadata:
  name: test-baseline
  namespace: test-ns
spec:
  hostNetwork: true  # Violates baseline
  containers:
  - name: app
    image: nginx:latest
```

```bash
# Test restricted compliance
kubectl create namespace test-ns
kubectl label namespace test-ns pod-security.kubernetes.io/enforce=restricted
kubectl apply -f test-restricted.yaml  # Should succeed
kubectl apply -f test-baseline.yaml 2>&1  # Should fail with Warning

# View violations
kubectl apply -f test-baseline.yaml 2>&1 | grep Warning

# Check audit events
kubectl get events -n test-ns --sort-by=.lastTimestamp

# Verify Pod security
kubectl get pod test-restricted -o jsonpath='{.metadata.annotations}' | jq

# Clean up
kubectl delete namespace test-ns
```

**Testing Approaches:**
- kubectl apply: test actual deployment.
- kubectl dry-run: test without deploying.
- Admission webhook: test at admission.

**Best Practices:**
- Test in non-production first.
- Use dry-run for validation.
- Monitor audit events.

DevOps: What is Kubernetes Pod Security Standards Testing?