Skip to main content
🎤 Luca Berton is speaking at Red Hat Summit & KubeCon EU 2026!Learn more →
Back to Blog
DevOps
kubernetes
Security
Pod Security

Kubernetes Pod Security Standards

Kubernetes Pod Security Standards for workload hardening. Privileged, Baseline, and Restricted profiles with YAML and migration tips.

Luca BertonFebruary 8, 20262 min read

Pod Security Standards define three security profiles that restrict what pods can do. They replaced PodSecurityPolicy (removed in K8s 1.25) with a simpler, built-in admission controller.

The Three Profiles

ProfilePurposeRestrictions
PrivilegedUnrestrictedNone — full access
BaselineMinimally restrictiveBlocks known privilege escalations
RestrictedHeavily restrictedBest practices enforced

What Each Profile Blocks

Baseline (prevents obvious exploits)

  • hostNetwork, hostPID, hostIPC
  • Privileged containers
  • Adding Linux capabilities beyond a safe set
  • HostPath volumes
  • Host ports
  • /proc mount types

Restricted (production hardening)

Everything in Baseline, plus: - Must run as non-root - Must drop ALL capabilities - Read-only root filesystem - Seccomp profile required (RuntimeDefault or Localhost) - No privilege escalation (allowPrivilegeEscalation: false)

Applying Pod Security Standards

Per Namespace

yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Enforce: reject pods that violate
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    
    # Warn: allow but show warning
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    
    # Audit: log violations
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
bash
# Apply to existing namespace
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=restricted

Gradual Rollout Strategy

yaml
# Step 1: Audit only (no enforcement)
pod-security.kubernetes.io/audit: restricted

# Step 2: Add warnings (still no enforcement)
pod-security.kubernetes.io/warn: restricted

# Step 3: Enforce after fixing violations
pod-security.kubernetes.io/enforce: restricted
Related Course

Master this topic with hands-on labs

Go beyond reading — build real projects in sandboxed environments with expert video guidance.

Browse Courses →

Compliant Pod Spec (Restricted)

yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: my-app:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        capabilities:
          drop:
            - ALL
      volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: cache
          mountPath: /app/.cache
  volumes:
    - name: tmp
      emptyDir: {}
    - name: cache
      emptyDir: {}

Common Violations and Fixes

Running as Root

yaml
# ❌ Violation
containers:
  - name: app
    image: my-app

# ✅ Fix
containers:
  - name: app
    image: my-app
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000

Update Dockerfile:

dockerfile
FROM node:22-alpine
RUN addgroup -S app && adduser -S app -G app
USER app
WORKDIR /home/app
COPY --chown=app:app . .
CMD ["node", "server.js"]

Privilege Escalation

yaml
# ❌ Violation (default allows escalation)
containers:
  - name: app

# ✅ Fix
containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

Writable Root Filesystem

yaml
# ✅ Read-only root + writable tmpfs
containers:
  - name: app
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
      - name: tmp
        mountPath: /tmp
      - name: logs
        mountPath: /app/logs
volumes:
  - name: tmp
    emptyDir: {}
  - name: logs
    emptyDir:
      sizeLimit: 100Mi

Missing Seccomp Profile

yaml
# ✅ Pod-level seccomp (applies to all containers)
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault

Namespace Configuration Matrix

NamespaceEnforceWarnAuditWhy
kube-systemprivilegedbaselinerestrictedSystem components need privileges
monitoringbaselinerestrictedrestrictedPrometheus needs some host access
productionrestrictedrestrictedrestrictedFull lockdown
stagingbaselinerestrictedrestrictedTesting toward restricted
developmentbaselinerestrictedrestrictedDeveloper flexibility
Stay Updated

Get weekly IT automation tips

Docker, Ansible, Terraform, MLOps — curated insights delivered to your inbox. No spam.

Subscribe Free →

Checking Compliance

bash
# Dry-run: test a pod against a profile
kubectl label --dry-run=server --overwrite ns production \
  pod-security.kubernetes.io/enforce=restricted

# Check audit logs for violations
kubectl get events -A --field-selector reason=FailedCreate

# List namespace security levels
kubectl get namespaces -L \
  pod-security.kubernetes.io/enforce,\
  pod-security.kubernetes.io/warn

Helm Chart Compatibility

Many Helm charts need security context overrides:

yaml
# values.yaml
podSecurityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  capabilities:
    drop:
      - ALL

What's Next?

Our SELinux for System Admins course covers OS-level security that complements Kubernetes Pod Security. Docker Fundamentals teaches container security basics. First lessons are free. -e ---

Ready to go deeper? Explore our hands-on DevOps courses — from Docker and Terraform to MLflow on Kubernetes.

Ready to learn by doing?

Stop reading tutorials — start building. Expert video courses with hands-on labs in real sandboxed environments.

Browse CoursesView Pricing
Share this article
LB
Luca Berton

Docker Captain, IT automation expert, Red Hat Summit & KubeCon speaker. Building hands-on education for DevOps engineers at CopyPasteLearn.

WebsiteTwitterLinkedIn

Related Articles

DevOps

Kubernetes RBAC for Beginners

Kubernetes RBAC from scratch. Roles, ClusterRoles, RoleBindings, ServiceAccounts, and practical examples for access control.

DevOps

Kubernetes Namespaces Multi-Tenancy

Kubernetes multi-tenancy with namespaces. Resource quotas, limit ranges, network policies, and RBAC for isolating teams.

DevOps

Kubernetes Network Policies Guide

Secure Kubernetes clusters with network policies. Default deny rules, namespace isolation, pod-level controls, and CNI compatibility.

DevOps

Kubernetes Pod Troubleshooting

Debug Kubernetes pods systematically. Fix CrashLoopBackOff, ImagePullBackOff, pending pods, and OOMKilled with diagnostic commands.

DevOps

Kubernetes Probes Liveness Readiness

Configure Kubernetes liveness, readiness, and startup probes. HTTP, TCP, exec checks with proper timing and misconfiguration fixes.

DevOps

Kubernetes Resource Requests Limits

Set Kubernetes CPU and memory requests and limits correctly. QoS classes, OOMKilled troubleshooting, and VPA right-sizing.

Explore topics

Browse more articles on the topics covered here.

#kubernetes#Security#Pod Security#DevOps#HardeningAutomation 29Docker 18Containers 14Ansible 13Linux 12cicd 11Networking 11observability 11