DevOps: What is Kubernetes Pod Security Standards Best Practices?

1# Recommended restricted Pod
2apiVersion: v1
3kind: Pod
4metadata:
5  name: best-practice-pod
6  namespace: production
7spec:
8  securityContext:
9    runAsNonRoot: true
10    runAsUser: 1000
11    runAsGroup: 1000
12    fsGroup: 1000
13    fsGroupChangePolicy: OnRootMismatch
14    seccompProfile:
15      type: RuntimeDefault
16  containers:
17  - name: app
18    image: nginx:latest
19    securityContext:
20      allowPrivilegeEscalation: false
21      readOnlyRootFilesystem: true
22      capabilities:
23        drop:
24        - ALL
25      runAsNonRoot: true
26      runAsUser: 1000
27    resources:
28      requests:
29        cpu: "250m"
30        memory: "256Mi"
31      limits:
32        cpu: "1000m"
33        memory: "512Mi"
34    volumeMounts:
35    - name: tmp
36      mountPath: /tmp
37    - name: cache
38      mountPath: /var/cache/nginx
39  volumes:
40  - name: tmp
41    emptyDir: {}
42  - name: cache
43    emptyDir: {}
44---
45# Namespace with all PSS labels
46apiVersion: v1
47kind: Namespace
48metadata:
49  name: production
50  labels:
51    pod-security.kubernetes.io/enforce: restricted
52    pod-security.kubernetes.io/enforce-version: latest
53    pod-security.kubernetes.io/audit: restricted
54    pod-security.kubernetes.io/audit-version: latest
55    pod-security.kubernetes.io/warn: restricted
56    pod-security.kubernetes.io/warn-version: latest

1# Check best practices
2kubectl get pod best-practice-pod -o jsonpath='{.spec.securityContext}' | jq
3kubectl get pod best-practice-pod -o jsonpath='{.spec.containers[0].securityContext}' | jq
4
5# Verify security
6kubectl exec best-practice-pod -- id
7kubectl exec best-practice-pod -- whoami
8kubectl exec best-practice-pod -- cat /proc/1/status | grep Cap
9
10# Check read-only filesystem
11kubectl exec best-practice-pod -- touch /test 2>&1
12
13# Verify seccomp profile
14kubectl get pod best-practice-pod -o jsonpath='{.spec.securityContext.seccompProfile}' | jq
15
16# Check namespace policy
17kubectl get namespace production -o yaml | grep pod-security