Skip to main content

Lab 9.3 - Pod Security Standards

Lab Objectives​

By the end of this lab, you will be able to:

  • Understand Pod Security Standards (PSS).
  • Apply security policies at the namespace level.
  • Test different levels (privileged, baseline, restricted).
  • Understand security restrictions.

Estimated Duration​

45-60 minutes

Prerequisites​

  • kubectl installed and configured.
  • Kubernetes cluster 1.23+ (for PSS).
  • Knowledge of Pod Security (Chapter 9.3).

Part 1: Understanding Pod Security Standards​

Kubernetes defines three security levels:

  • privileged: No restrictions (disabled by default).
  • baseline: Minimal restrictions to prevent known vulnerabilities.
  • restricted: Strict restrictions following best practices.

Part 2: Applying to a Namespace​

Step 2.1: Create a Namespace with PSS​

Create a namespace with the baseline level:

kubectl create namespace pss-test

Apply the Pod Security Standard:

kubectl label namespace pss-test pod-security.kubernetes.io/enforce=baseline
kubectl label namespace pss-test pod-security.kubernetes.io/audit=baseline
kubectl label namespace pss-test pod-security.kubernetes.io/warn=baseline

Verify:

kubectl get namespace pss-test --show-labels

Part 3: Testing with Baseline​

Step 3.1: Create a Baseline-Compliant Pod​

Create pod-baseline.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-baseline
  namespace: pss-test
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sleep", "3600"]
    securityContext:
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL

Apply:

kubectl apply -f pod-baseline.yaml

Part 4: Testing with Restricted​

Step 4.1: Change the Level to Restricted​

Change the level to restricted:

kubectl label namespace pss-test pod-security.kubernetes.io/enforce=restricted --overwrite

Step 4.2: Test a Non-Compliant Pod​

Create pod-non-compliant.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-non-compliant
  namespace: pss-test
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sleep", "3600"]
    # Missing securityContext required for restricted

Try to create the Pod:

kubectl apply -f pod-non-compliant.yaml

The Pod should be rejected with a security error.

Part 5: Compliant Pod with Restricted​

Create pod-restricted.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-restricted
  namespace: pss-test
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: busybox:1.35
    command: ["sleep", "3600"]
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      runAsUser: 1000
      capabilities:
        drop:
        - ALL

Apply:

kubectl apply -f pod-restricted.yaml

Part 6: Cleanup​

kubectl delete pod pod-baseline -n pss-test
kubectl delete pod pod-restricted -n pss-test
kubectl delete namespace pss-test

Lab Summary​

In this lab, you applied Pod Security Standards at the namespace level. You tested the different security levels and understood the restrictions.

Next Steps​

The last lab of this module will show you how to perform a security audit.

Lab 9.4: Security Audit

Lab created on: December 2024