Apply Pod Security Standards at the Namespace Level

Note

Pod Security admission (PSA) is enabled by default in v1.23 and later, as it graduated to beta. Pod Security Admission is an admission controller that applies when pods are created. In this tutorial, you will enforce the Pod Security Standard, one namespace at a time.

You can also apply Pod Security Standards to multiple namespaces at once at the cluster level. For instructions, refer to Apply Pod Security Standards at the cluster level.

Install the following on your workstation:

Create cluster

  1. Create a KinD cluster as follows:

    The output is similar to this:

    1. Creating cluster "psa-ns-level" ...
    2.  ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 
    3.  ✓ Preparing nodes 📦  
    4.  ✓ Writing configuration 📜 
    5.  ✓ Starting control-plane 🕹️ 
    6.  ✓ Installing CNI 🔌 
    7.  ✓ Installing StorageClass 💾 
    8. You can now use your cluster with:
    10. kubectl cluster-info --context kind-psa-ns-level
    12. Not sure what to do next? 😅  Check out https://kind.sigs.k8s.io/docs/user/quick-start/

  2. Set the kubectl context to the new cluster:

    1. kubectl cluster-info --context kind-psa-ns-level
    1. Kubernetes control plane is running at https://127.0.0.1:50996
    4. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

Create a new namespace called example:

The output is similar to this:

  1. namespace/example created

Apply Pod Security Standards

  1. Enable Pod Security Standards on this namespace using labels supported by built-in Pod Security Admission. In this step we will warn on baseline pod security standard as per the latest version (default value)

    1. kubectl label --overwrite ns example \
    2.    pod-security.kubernetes.io/warn=baseline \
    3.    pod-security.kubernetes.io/warn-version=latest

  2. Multiple pod security standards can be enabled on any namespace, using labels. Following command will enforce the baseline Pod Security Standard, but warn and audit for restricted Pod Security Standards as per the latest version (default value)

    1. kubectl label --overwrite ns example \
    2.   pod-security.kubernetes.io/enforce-version=latest \
    3.   pod-security.kubernetes.io/warn=restricted \
    5.   pod-security.kubernetes.io/audit=restricted \
    6.   pod-security.kubernetes.io/audit-version=latest

  1. Create a minimal pod in example namespace:

  2. Apply the pod spec to the cluster in example namespace:

    1. kubectl apply -n example -f /tmp/pss/nginx-pod.yaml
    1. Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
    2. pod/nginx created

  3. Apply the pod spec to the cluster in default namespace:

    1. kubectl apply -n default -f /tmp/pss/nginx-pod.yaml

    Output is similar to this:

The Pod Security Standards were applied only to the example namespace. You could create the same Pod in the default namespace with no warnings.

Clean up

Run kind delete cluster --name psa-ns-level to delete the cluster created.

  • Run a shell script to perform all the preceding steps all at once.

    1. Create KinD cluster
    2. Create new namespace
    3. Apply baseline Pod Security Standard in enforce mode while applying restricted Pod Security Standard also in warn and mode.
    4. Create a new pod with the following pod security standards applied

  • Apply Pod Security Standards at the cluster level