What is Kubernetes Pod Security Standards Automation?

Question

Accepted Answer

**Automation** — automate Pod security policy enforcement.

```yaml
# Kyverno ClusterPolicy for PSS
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-restricted
spec:
  validationFailureAction: Enforce
  background: true
  rules:
  - name: require-run-as-non-root
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Running as root is not allowed"
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true
  - name: require-seccomp
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Seccomp profile is required"
      pattern:
        spec:
          securityContext:
            seccompProfile:
              type: RuntimeDefault
  - name: restrict-privilege-escalation
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Privilege escalation is not allowed"
      pattern:
        spec:
          containers:
          - securityContext:
              allowPrivilegeEscalation: false
---
# OPA Gatekeeper constraint
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8spspallowedusers
spec:
  crd:
    spec:
      names:
        kind: K8sPSPAllowedUsers
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8spspallowedusers
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.runAsNonRoot
          msg := sprintf("Container %v must run as non-root", [container.name])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowedUsers
metadata:
  name: require-non-root
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    namespaces: ["production"]
```

```bash
# Install Kyverno
helm install kyverno kyverno/kyverno -n kyverno --create-namespace

# Install Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

# Check policies
kubectl get clusterpolicy
kubectl get constrainttemplates

# Test policy
kubectl apply -f non-compliant-pod.yaml 2>&1

# View policy violations
kubectl get clusterpolicyreport
kubectl get policyreport -A

# Check admission webhook
kubectl get validatingwebhookconfigurations | grep kyverno
kubectl get validatingwebhookconfigurations | grep gatekeeper
```

**Automation Tools:**
- Kyverno: Kubernetes-native policies.
- OPA Gatekeeper: Rego-based policies.
- Pod Security Standards: built-in.

**Best Practices:**
- Start with audit mode.
- Test in non-production.
- Monitor violations.
- Gradually enforce.

DevOps: What is Kubernetes Pod Security Standards Automation?