What is Kubernetes Pod Security Standards Monitoring?

Question

Accepted Answer

**Monitoring** — track Pod security compliance.

```yaml
# PrometheusRule for PSS violations
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: pss-violations
  namespace: monitoring
spec:
  groups:
  - name: pss
    rules:
    - alert: PodSecurityPolicyViolation
      expr: increase(kubernetes_audit_event_total{verb="create",resource="pods",user_agent!="kube-controller-manager"}[5m]) > 0
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "Pod security policy violation detected"
        description: "Namespace {{ $labels.namespace }} has Pod security violations"
---
# Grafana dashboard for PSS
apiVersion: v1
kind: ConfigMap
metadata:
  name: pss-dashboard
  namespace: monitoring
data:
  pss-dashboard.json: |
    {
      "panels": [
        {
          "title": "PSS Violations by Namespace",
          "targets": [
            {
              "expr": "sum(rate(kubernetes_audit_event_total{verb=\"create\",resource=\"pods\"}[5m])) by (namespace)",
              "legendFormat": "{{ namespace }}"
            }
          ]
        }
      ]
    }
```

```bash
# Check audit events
kubectl get events -A --sort-by=.lastTimestamp | grep -i "audit\|warn\|error"

# View PSS violations
kubectl get events -A --field-selector reason=FailedCreate --sort-by=.lastTimestamp

# Check namespace compliance
kubectl get namespaces -o json | jq '.items[] | {name: .metadata.name, labels: .metadata.labels}' | grep pod-security

# Monitor Pod security
kubectl get pods -A -o json | jq '.items[] | {name: .metadata.name, namespace: .metadata.namespace, securityContext: .spec.securityContext}'

# Check Prometheus alerts
kubectl get prometheusrule -n monitoring
kubectl describe prometheusrule pss-violations -n monitoring

# View Grafana dashboard
kubectl get configmap pss-dashboard -n monitoring -o yaml
```

**Monitoring Tools:**
- Prometheus: metrics collection.
- Grafana: visualization.
- AlertManager: alerting.

**Metrics:**
- kubernetes_audit_event_total.
- Pod security annotations.
- Namespace policy labels.

DevOps: What is Kubernetes Pod Security Standards Monitoring?