What is Kubernetes Pod Security Standards Troubleshooting?

Question

Accepted Answer

**Troubleshooting** — debug Pod security policy violations.

```yaml
# Namespace with restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
---
# Non-compliant Pod
apiVersion: v1
kind: Pod
metadata:
  name: troubleshoot-pod
  namespace: production
spec:
  containers:
  - name: app
    image: nginx:latest
    # Missing security context
```

```bash
# Test compliance
kubectl apply -f troubleshoot-pod.yaml 2>&1

# View detailed error
kubectl apply -f troubleshoot-pod.yaml 2>&1 | grep -A 5 "Error"

# Check namespace policy
kubectl get namespace production -o yaml | grep pod-security

# View audit events
kubectl get events -n production --sort-by=.lastTimestamp | grep -i "audit\|warn\|error"

# Check for violations
kubectl get events -n production --field-selector reason=FailedCreate --sort-by=.lastTimestamp

# Test with dry-run
kubectl apply -f troubleshoot-pod.yaml --dry-run=server 2>&1

# Check Pod annotations
kubectl get pod troubleshoot-pod -o jsonpath='{.metadata.annotations}' 2>/dev/null | jq

# Verify security context
kubectl get pod troubleshoot-pod -o jsonpath='{.spec.securityContext}' 2>/dev/null | jq
```

**Common Issues:**
- Missing securityContext.
- Running as root.
- Privileged container.
- Missing seccomp profile.

**Debug Steps:**
1. Check namespace policy.
2. View error messages.
3. Check audit events.
4. Fix Pod configuration.
5. Re-apply.

DevOps: What is Kubernetes Pod Security Standards Troubleshooting?