Implementing Kubernetes Pod Security Standards

Overview

Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.

When to Use

• Deciding whether a namespace or workload belongs at Privileged, Baseline, or Restricted
• Auditing which existing workloads would be rejected if Restricted were enforced today
• Translating a "must meet Restricted" requirement into concrete securityContext changes
• Planning a PodSecurityPolicy migration and predicting what will break before it does
• Mapping pod security posture to a compliance control (NIST PR.PS-01, CIS Kubernetes)

Not this skill: configuring the controller that enforces these profiles — namespace labels, AdmissionConfiguration, exemptions, or debugging a pod PSA rejected. Use implementing-pod-security-admission-controller.

Prerequisites