Enforce Pod Security Admission

Apply the restricted Pod Security Standard namespace by namespace so privileged pods are rejected at admission.

~35 minkubernetessecurityhardening

Task

Enforce restricted pod security on namespaces and verify privileged pods are denied.

When to use this

Any team can deploy privileged pods, undermining isolation intent and any runtime controls.

Prerequisites

Kubernetes 1.25 or later with Pod Security Admission
Namespace labels to set
A test pod manifest

Steps

1. Label namespaces with the restricted profile.

kubectl label --overwrite ns production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted

Expected output: The namespace rejects pods that violate the restricted standard.

2. Prove that a privileged pod is denied.

kubectl -n production run bad --image=busybox --privileged=true --restart=Never -- sleep 1

Expected output: Admission rejects the pod with a pod security violation, as intended.

Troubleshooting

Problem

Legitimate workload rejected

Solution

Use audit and warn modes first to find violations, then remediate and enforce.

Problem

System components break

Solution

Exempt kube-system and infrastructure namespaces deliberately, not wholesale.

Limitations

Restricted profile may be too strict for some workloads.
Does not cover runtime behaviour after admission.
Requires workload remediation effort.

What this recipe does

Enforce restricted pod security on namespaces and verify privileged pods are denied.

Any team can deploy privileged pods, undermining isolation intent and any runtime controls.

Prerequisites

Kubernetes 1.25 or later with Pod Security Admission
Namespace labels to set
A test pod manifest

Procedure

Label namespaces with the restricted profile.

kubectl label --overwrite ns production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted

Expected result: The namespace rejects pods that violate the restricted standard.

Prove that a privileged pod is denied.

kubectl -n production run bad --image=busybox --privileged=true --restart=Never -- sleep 1

Expected result: Admission rejects the pod with a pod security violation, as intended.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows privileged pods are rejected in restricted namespaces while compliant workloads still schedule.

Troubleshooting

Legitimate workload rejected — Use audit and warn modes first to find violations, then remediate and enforce.

System components break — Exempt kube-system and infrastructure namespaces deliberately, not wholesale.

Limitations

Restricted profile may be too strict for some workloads.
Does not cover runtime behaviour after admission.
Requires workload remediation effort.