What is Kubernetes Pod Security Standards Migration?

Question

Accepted Answer

**Migration** — transition from PodSecurityPolicy to Pod Security Standards.

```yaml
# Phase 1: Audit mode
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
---
# Phase 2: Warn mode
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
---
# Phase 3: Enforce mode
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
```

```bash
# Step 1: Remove PodSecurityPolicy
kubectl delete podsecuritypolicy privileged
kubectl delete podsecuritypolicy restricted

# Step 2: Add audit labels
kubectl label namespace production pod-security.kubernetes.io/audit=restricted --overwrite
kubectl label namespace production pod-security.kubernetes.io/audit-version=latest --overwrite

# Step 3: Monitor audit events
kubectl get events -n production --sort-by=.lastTimestamp | grep -i audit

# Step 4: Add warn labels
kubectl label namespace production pod-security.kubernetes.io/warn=restricted --overwrite
kubectl label namespace production pod-security.kubernetes.io/warn-version=latest --overwrite

# Step 5: Fix violations
kubectl apply -f pod.yaml 2>&1 | grep Warning

# Step 6: Add enforce labels
kubectl label namespace production pod-security.kubernetes.io/enforce=restricted --overwrite
kubectl label namespace production pod-security.kubernetes.io/enforce-version=latest --overwrite

# Step 7: Verify enforcement
kubectl apply -f non-compliant.yaml  # Should fail
```

**Migration Steps:**
1. Audit: log violations.
2. Warn: show warnings.
3. Fix: update workloads.
4. Enforce: reject non-compliant.

**Best Practices:**
- Gradual migration.
- Test in non-production first.
- Monitor audit events.

DevOps: What is Kubernetes Pod Security Standards Migration?