k8s-security-policies

K8s Security Policies

Pod Security Standards, NetworkPolicy patterns, admission control strategies, and workload security enforcement.

Knowledge Base

Pod Security Standards (PSS) -- The Three Profiles

Pod Security Standards define three progressively restrictive security profiles. These are not policies themselves -- they are standards that admission controllers enforce.

Profile	Purpose	Restrictions
Privileged	Unrestricted. For system-level workloads.	None. Everything allowed.
Baseline	Prevents known privilege escalations. Minimally restrictive.	No privileged containers, no hostPath, no hostNetwork/PID/IPC, restricted capabilities, restricted volume types, no host ports
Restricted	Heavily restricted. Best practice for untrusted workloads.	Baseline + must run as non-root, must drop ALL capabilities (may add NET_BIND_SERVICE), seccomp profile required, restricted seccomp/AppArmor profiles

Pod Security Admission (PSA) Controller

PSA is the built-in admission controller that enforces PSS. Three modes per namespace:

Mode	Behavior
enforce	Violations are rejected. Pod will not be created.
audit	Violations are recorded in audit log but pod is created.
warn	Violations generate a warning to the user but pod is created.

Best practice: Start with audit + warn, fix violations, then switch to enforce.

# Namespace labels for PSA
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest

NetworkPolicy Fundamentals

NetworkPolicy is Kubernetes' built-in network segmentation. Key behaviors:

• Without any NetworkPolicy, all pods can communicate with all other pods (cluster-wide flat network).
• Once any NetworkPolicy selects a pod (via podSelector), that pod's traffic is restricted to what the policies explicitly allow.
• NetworkPolicies are additive -- multiple policies selecting the same pod combine their allowed traffic.
• NetworkPolicies are namespace-scoped but can reference other namespaces via namespaceSelector.
• Egress policies are often forgotten -- even with ingress restrictions, a compromised pod can phone home without egress controls.
• DNS egress must be explicitly allowed when using egress policies (UDP port 53 to kube-dns).