Pod Security Standards: A Security Checklist for Pods

WHY IT EXISTS: Kubernetes needed a simpler, built-in way to enforce pod security best practices after deprecating the complex PodSecurityPolicy (PSP). PSS provides standardized, tiered security levels that are easier to manage and apply consistently across a cluster.

THE MENTAL MODEL: Think of PSS as building codes for your cluster's "neighborhoods" (namespaces). You label a namespace with a security level—like Restricted for a hospital or Baseline for an office building—and the cluster's admission controller rejects any new "house" (pod) that doesn't meet that code.

HOW IT WORKS: PSS is enforced by the built-in Pod Security Admission Controller. You add a label to a namespace, such as pod-security.kubernetes.io/enforce: baseline. This tells Kubernetes to check every pod created in that namespace against the Baseline policy. The three levels are Privileged (unrestricted), Baseline (prevents known escalations, a good default), and Restricted (heavily hardened). You can also use audit and warn modes to test policies without breaking applications.

WHEN TO USE IT: Use PSS in any modern Kubernetes cluster (v1.25+ where PSP is removed) to establish a security baseline. Apply the Baseline policy to most application namespaces to prevent common misconfigurations. Use the Restricted policy for namespaces running sensitive or multi-tenant workloads. The warn mode is excellent for gradually rolling out policies to existing clusters.

WHEN NOT TO USE IT: The Privileged level should be used sparingly, only for trusted, system-level components that genuinely need elevated permissions, like certain monitoring agents or storage drivers. Avoid using PSS on very old clusters that still rely on PodSecurityPolicy, as the two mechanisms can conflict.

ONE CANONICAL EXAMPLE: To enforce the Baseline standard on all new pods in the my-app-ns namespace and warn about violations of the Restricted standard, you would apply two labels to the namespace object: pod-security.kubernetes.io/enforce: baseline and pod-security.kubernetes.io/warn: restricted. This blocks pods that fail the Baseline check while only logging warnings for pods that fail the stricter check, giving you a path to gradually harden security.