This lab will show you how to:
- Enable PSA on a namespace
- Attempt to deploy a non-compliant pod
- Modify the pod to comply with the
restrictedprofile
psa-lab/
├── namespace.yaml
├── privileged-pod.yaml
└── restricted-pod.yaml
PSA is enforced via labels on the namespace.
apiVersion: v1
kind: Namespace
metadata:
name: psa-lab
labels:
pod-security.kubernetes.io/enforce: "restricted"
pod-security.kubernetes.io/enforce-version: "latest"Apply it:
kubectl apply -f namespace.yamlThis pod will violate the restricted policy because it uses privileged: true.
apiVersion: v1
kind: Pod
metadata:
name: privileged-pod
namespace: psa-lab
spec:
containers:
- name: ubuntu
image: ubuntu@sha256:6015f66923d7afbc53558d7ccffd325d43b4e249f41a6e93eef074c9505d2233
command: [ "sh", "-c", "sleep 1h" ]
securityContext:
privileged: trueTry applying it:
kubectl apply -f privileged-pod.yaml🔒 You should see an error like this:
Error from server (Forbidden): error when creating "privileged-pod.yaml": pods "privileged-pod" is forbidden: violates PodSecurity "restricted:latest": privileged (container "ubuntu" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "ubuntu" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ubuntu" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ubuntu" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ubuntu" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Update the pod to meet the requirements:
apiVersion: v1
kind: Pod
metadata:
name: restricted-pod
namespace: psa-lab
spec:
containers:
- name: ubuntu
image: ubuntu@sha256:6015f66923d7afbc53558d7ccffd325d43b4e249f41a6e93eef074c9505d2233
command: [ "sh", "-c", "sleep 1h" ]
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: RuntimeDefaultApply it:
kubectl apply -f restricted-pod.yaml✅ This time, it should deploy successfully.
pod/restricted-pod created