Pod Security Admission in Kubernetes 1.25+: A Complete Guide

In Kubernetes 1.25+, Pod Security Admission (PSA) replaces the deprecated Pod Security Policies (PSP). This built-in controller helps enforce security standards for pod creation and modifications, ensuring safer deployments. Let’s explore how PSA works and how you can use it to secure your Kubernetes environment.

Understanding Pod Security Admission in Kubernetes

Pod Security Admission is an admission controller introduced in Kubernetes 1.25. It provides an effective way to enforce pod security at both creation and modification stages. PSA offers a more streamlined and manageable approach to securing pods compared to the deprecated Pod Security Policies.

Securing Kubernetes pods with Pod Security Admission in Kubernetes 1.25+.

How Pod Security Admission Works

PSA operates on three predefined security levels:

Privileged: This level is unrestricted and should be used sparingly, as it exposes pods to significant vulnerabilities.
Baseline: A moderate level that prevents common privilege escalations while ensuring broad compatibility.
Restricted: The most secure option, enforcing strict standards to minimize attack surfaces and enforce best security practices.

With these levels, Kubernetes administrators can ensure that each pod complies with the security standards required for their organization.

How to Implement Pod Security Admission in Kubernetes

Now that we understand Pod Security Admission, let’s dive into the steps for implementing it in your Kubernetes cluster.

Step 1: Enable Pod Security Admission

PSA is enabled by default in Kubernetes 1.25 and later. To verify that PSA is active, check your admission configuration:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: "podsecurity.webhook.admission.k8s.io"

Step 2: Label Namespaces for PSA

Use namespace labels to define the security level for your pods. For example, to apply the baseline security level:

kubectl label ns <namespace-name> pod-security.kubernetes.io/enforce=baseline

This command sets the baseline security level for the namespace. You can adjust this label to restricted or privileged as necessary.

Step 3: Enforce Pod Security Standards

After labeling the namespace, the next step is to configure the security standards. For instance, to apply the restricted level:

kubectl label ns <namespace-name> pod-security.kubernetes.io/enforce=restricted

This ensures all pods within the namespace comply with restricted security standards.

Example: Deploying a Secure Pod

Let’s see how a secure pod is deployed when the namespace is labeled as restricted. The following YAML manifest defines a pod that adheres to the highest security standards:

Secure Pod Manifest

apiVersion: v1
kind: Pod
metadata:
  name: secure-example
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: secure-container
    image: nginx:stable
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]

This configuration ensures that the pod runs as a non-root user, restricts privilege escalation, and enforces a restricted security posture.

Best Practices for Pod Security Admission

To make the most of Pod Security Admission, follow these best practices:

1. Gradual Adoption of Security Levels

Start with the privileged security level for existing applications, then move to baseline, and finally aim for the restricted level to ensure smooth adoption without major disruptions.

2. Regular Audits and Monitoring

Use Kubernetes’ audit and warn modes to identify non-compliant pods. This allows you to monitor your security posture and make adjustments as needed without enforcing changes immediately.

3. Keep Your Team Updated

Kubernetes security is constantly evolving. Ensure your team stays informed about the latest changes and best practices, so they can effectively implement Pod Security Admission across your environment.

Conclusion: Secure Your Kubernetes Deployments with Pod Security Admission

With Pod Security Admission in Kubernetes 1.25+, administrators can ensure that their Kubernetes environments are secure and compliant with best practices. PSA provides clear, enforceable security levels, making it easier to protect your clusters and mitigate potential vulnerabilities.

At ZippyOPS, we offer consulting, implementation, and managed services to help businesses adopt Kubernetes security best practices, including DevSecOps, Cloud, Automated Ops, and Microservices. Our experts guide you in enhancing the security posture of your containerized environments.

Explore our Services, learn more about our Solutions, and discover our Products. For more details, watch our YouTube videos.

For more information, reach out to us at sales@zippyops.com.