In this lesson, you will learn how Pod Security Admissions (PSA) acts as the built-in gatekeeper for your cluster by enforcing security standards at the namespace level.
The Problem: Pod Security Contexts
Previously, Kubernetes relied on PodSecurityPolicies, which were complex and difficult to manage. PSA replaces this by using a standardized set of profiles: Privileged, Baseline, and Restricted. These profiles define exactly what a pod is allowed to do, such as whether it can run as root, access the host filesystem, or use privileged capabilities.
How PSA Architecture Works
Pod Security Admissions works as a built-in Kubernetes controller. It operates by validating or mutating pod specifications against the labels you apply to a namespace. Unlike complex external tools, PSA is native to the API server. You don't install it; you simply configure it by adding specific labels to your namespaces.
Enforcing Standards
To enforce these policies, you label a namespace with the desired security level and the enforcement mode. For example, if you want to ensure that no pods in the production namespace run as root or escape their container, you would apply labels like this:
kubectl label namespace production \
pod-security.kubernetes.io/enforce=restricted \
pod-security.kubernetes.io/enforce-version=latest
Once this label is applied, the admission controller intercepts every request to create a pod in that namespace. If a pod’s configuration violates the restricted profile, the Kubernetes API server will reject the request entirely, preventing insecure containers from ever entering the cluster.
Modes of Operation
You can choose how strictly PSA behaves:
- Enforce: The request is rejected if it violates the policy.
- Audit: The request is allowed, but the violation is recorded in the audit logs.
- Warn: The request is allowed, but the user receives a warning message in their terminal.
This tiered approach allows you to "test the waters" in a namespace using warn mode before switching to enforce to fully lock down your environment. By leveraging these labels, you maintain a consistent security posture without needing to manage complex, custom admission webhooks.
Key Takeaway: Pod Security Admissions allows you to enforce standardized security profiles across your cluster simply by applying specific labels to your namespaces.