DevOps Bootcamp · Lesson

Pod Security Standards

Apply Pod Security Standards to enforce security best practices at the Pod level.

Pod Security Standards is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What are PSS?

Kubernetes Pod Security Standards (PSS) are a set of guidelines and controls for enforcing security best practices on your Pods.

They help protect your cluster from common security vulnerabilities and privilege escalation attacks by restricting what Pods can do.

Think of them as a security checklist for your Pods!

Three Levels of Security

PSS defines three distinct security levels, each offering a different degree of protection:

Privileged: Unrestricted, the least secure.
Baseline: Prevents known privilege escalations.
Restricted: Enforces hardened security best practices.

These levels are cumulative, meaning Restricted includes all Baseline protections, and Baseline includes all Privileged (or rather, no restrictions).

Privileged: Unrestricted Access

The Privileged PSS level offers an unrestricted security policy.

This means Pods running under this policy can request any capability and have full access to the host's resources and namespaces, similar to running as root on the host machine.

It's generally considered highly unsafe and should only be used for system-level workloads that absolutely require such access.

Baseline: Preventing Exploits

The Baseline PSS level aims to prevent known privilege escalations.

It's a good starting point for most user-defined applications.

Key restrictions include:

No privileged containers.
No hostPath volumes (except specific safe types).
No host networking or PID namespace sharing.
Limited capabilities.

This level helps mitigate many common attack vectors.

Restricted: Hardened Security

The Restricted PSS level enforces hardened security best practices.

It's designed for highly security-sensitive applications and requires Pods to run with minimal privileges.

Beyond Baseline's restrictions, Restricted enforces:

Running as a non-root user.
Dropping all Linux capabilities and only adding specific required ones.
Requiring seccomp and AppArmor profiles.

This is the most secure and strictest PSS level.

Enforcing PSS with Admission

Pod Security Standards are enforced using a Kubernetes feature called Pod Security Admission.

This admission controller intercepts Pod creation requests and checks them against the PSS level configured for the Pod's namespace.

You apply PSS levels to namespaces by adding specific labels to them. For example:

kubectl label namespace <namespace-name> pod-security.kubernetes.io/enforce=restricted

Controlling Pod Security

To make your Pods compliant with PSS, you'll often use the securityContext field in your Pod definition.

This field allows you to define privilege and access control settings for a Pod or individual containers within it.

Common settings include:

runAsUser: Specifies the user ID for the container process.
allowPrivilegeEscalation: Prevents a process from gaining more privileges than its parent.
capabilities: Manages Linux capabilities.

Unsafe Pod Example

Let's look at a Pod definition that would violate the Baseline PSS due to its security context. This is generally unsafe:

apiVersion: v1
kind: Pod
metadata:
  name: unsafe-pod
spec:
  containers:
  - name: my-container
    image: nginx
    securityContext:
      privileged: true
      # This allows the container to run with root capabilities
      # and access host devices directly.
      # Violates Baseline PSS.

Baseline-Compliant Pod Example

Here's how you'd define a Pod that adheres to the Baseline PSS level. Notice the absence of privileged: true and other restrictions.

For even stricter Restricted compliance, you'd add runAsNonRoot: true, readOnlyRootFilesystem: true, and drop all capabilities.

apiVersion: v1
kind: Pod
metadata:
  name: safe-pod
spec:
  containers:
  - name: my-container
    image: nginx
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      # This Pod runs with minimal privileges and
      # adheres to the Baseline PSS.

PSS Quick Check

Which of the following statements about Pod Security Standards (PSS) is TRUE?

Recap: Pod Security Standards

In this lesson, you learned about Kubernetes Pod Security Standards (PSS) and their importance for securing your cluster.

PSS define three levels: Privileged, Baseline, and Restricted.
Baseline prevents known privilege escalations, suitable for most apps.
Restricted enforces hardened security, requiring minimal privileges.
The securityContext field helps configure Pods to comply with PSS.

Applying PSS is a crucial step towards building more secure Kubernetes environments!

Frequently asked questions

Is the “Pod Security Standards” lesson free?

Yes — the full text of “Pod Security Standards” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Pod Security Standards”?

Apply Pod Security Standards to enforce security best practices at the Pod level. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Pod Security Standards” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to DevOps Bootcamp