RBAC controls who can create Pods. Pod Security Standards control what those Pods can do. Even if a user has permission to create Pods, the PodSecurity admission controller can reject Pods that request dangerous capabilities (privileged, hostNetwork, root). This is the built-in defense against container escape.

1. The Three Security Levels

What Each Level Restricts

2. Enforcement Modes

The PodSecurity admission controller (built-in since K8s 1.25) enforces standards at three modes per namespace:

Configuration via Namespace Labels

# Apply Pod Security Standards to a namespace using labels:
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

# Or in the namespace manifest:
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest

Label Format

# pod-security.kubernetes.io/{mode}: {level}
# pod-security.kubernetes.io/{mode}-version: {version}

# mode: enforce | warn | audit
# level: privileged | baseline | restricted
# version: latest | v1.28 | v1.27 ... (pin to specific K8s version's rules)

3. Practical: What Gets Blocked

Pod Rejected by "Restricted" Level

# This Pod violates Restricted in multiple ways:
apiVersion: v1
kind: Pod
metadata:
  name: bad-pod
  namespace: production    # enforce=restricted
spec:
  containers:
    - name: app
      image: nginx
      securityContext:
        runAsUser: 0                      # ❌ Root (must be non-root)
        allowPrivilegeEscalation: true    # ❌ Must be false
        # Missing seccompProfile          # ❌ Must have RuntimeDefault or Localhost

# Result:
# Error: pods "bad-pod" is forbidden: violates PodSecurity "restricted:latest":
#   allowPrivilegeEscalation != false
#   runAsNonRoot != true
#   seccompProfile not set

Pod That Passes "Restricted"

apiVersion: v1
kind: Pod
metadata:
  name: good-pod
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true                    # ✓ Pod-level: must be non-root
    seccompProfile:
      type: RuntimeDefault                # ✓ Seccomp required
  containers:
    - name: app
      image: nginx:1.25
      securityContext:
        allowPrivilegeEscalation: false   # ✓ Must be false
        capabilities:
          drop: ["ALL"]                   # ✓ Drop all capabilities
          add: ["NET_BIND_SERVICE"]       # ✓ Only this one is allowed
        readOnlyRootFilesystem: true      # Good practice (not required by restricted)
      ports:
        - containerPort: 8080

4. Migration Strategy

Step-by-Step Rollout

1. Audit first: Label namespaces with audit: restricted. Check audit logs for violations.
2. Warn next: Add warn: restricted. Developers see warnings on kubectl apply.
3. Fix violations: Update Deployments to pass Restricted (add securityContext fields).
4. Enforce: Once clean, add enforce: restricted. Non-compliant Pods are blocked.

# Dry-run: check what would be violated without enforcing:
kubectl label ns production --dry-run=server --overwrite \
  pod-security.kubernetes.io/enforce=restricted
# Shows warnings for existing Pods that would violate

# Or use kubectl-pss plugin to scan:
kubectl auth can-i --list -n production  # (no direct tool — use warn mode)

Exemptions

Some system Pods (kube-system, monitoring) need elevated privileges. Configure exemptions in the PodSecurity admission configuration:

# In the admission configuration (AdmissionConfiguration):
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
  - name: PodSecurity
    configuration:
      apiVersion: pod-security.admission.config.k8s.io/v1
      kind: PodSecurityConfiguration
      defaults:
        enforce: baseline
        enforce-version: latest
      exemptions:
        usernames: []
        runtimeClasses: []
        namespaces:
          - kube-system              # Exempt kube-system from enforcement
          - kube-node-lease
          - monitoring               # Prometheus needs elevated access

5. Pod Security Standards vs PodSecurityPolicy (Legacy)

Summary

securityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
containers:
  - securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]