SELinux — Mandatory Access Control for Pod security.
1apiVersion: v12kind: Pod3metadata:4 name: selinux-pod5spec:6 securityContext:7 seLinuxOptions:8 level: "s0:c123,c456"9 type: "my_app_t"10 containers:11 - name: app12 image: nginx:latest
1kubectl exec selinux-pod -- getenforce2kubectl exec selinux-pod -- id -Z
Options: level, type, user, role.