Enforce the restricted pod security standard

How to do it

The restricted standard refuses pods that run as root, add capabilities, allow privilege escalation or skip the default seccomp profile. That is the Kubernetes form of Never give a container control of the host. The built-in pod security admission reads three labels per namespace, enforce, audit and warn. Turn on warn and audit first, fix what they report, then enforce. System add-ons that need host access, such as a network plugin, get their own namespace with a written reason.

Examples

YAML example

apiVersion: v1
kind: Namespace
metadata:
  name: shop
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

YAML example 2

# A container that passes the restricted standard
securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities: { drop: [ALL] }
  seccompProfile: { type: RuntimeDefault }

How to check

Every namespace except the listed system ones has the label pod-security.kubernetes.io/enforce=restricted. A test pod that runs as root is refused in each of them.

Sources

• Kubernetes, Pod Security Standards
• Kubernetes, Pod Security Admission

Related rules

• INF-74 Never give a container control of the host in Infrastructure and environments