Pod Security Standards [page]deterministic
A detailed look at the different policy levels defined in the Pod Security Standards.
The Pod Security Standards define three different _policies_ to broadly cover the security spectrum. These policies are _cumulative_ and range from highly-permissive to highly-restrictive. This guide outlines the requirements of each policy.
| Profile | Description | | ------ | ----------- | | <strong style="white-space: nowrap">Privileged</strong> | Unrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations. | | <strong style="white-space: nowrap">Baseline</strong> | Minimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration. | | <strong style="white-space: nowrap">Restricted</strong> | Heavily restricted policy, following current Pod hardening best practices. |
## Profile Details
### Privileged
The _Privileged_ policy is purposely-open, and entirely unrestricted. This type of policy is typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.
The Privileged policy is defined by an absence of restrictions. If you define a Pod where the Privileged security policy applies, the Pod you define is able to bypass typical container isolation mechanisms. For example, you can define a Pod that has access to the node's host network.
### Baseline
**The _Baseline_ policy is aimed at ease of adoption for common containerized workloads while preventing known privilege escalations.** This policy is targeted at application operators and developers of non-critical applications. The following listed controls should be enforced/disallowed:
> Note: In this table, wildcards (`*`) indicate all elements in a list. For example, `spec.containers[*].securityContext` refers to the Security Context object for _all defined containers_. If any of the listed containers fails to meet the requirements, the entire pod will fail validation.
<table> <caption style="display:none">Baseline policy specification</caption> <tbody> <tr> <th>Control</th> <th>Policy</th> </tr> <tr> <td style="white-space: nowrap">HostProcess</td> <td> <p>Windows Pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">HostProcess containers</a> which enables privileged access to the Windows host machine. Privileged access to the host is disallowed in the Baseline policy. </p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.containers[*].securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.initContainers[*].securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>false</code></li> </ul> </td> </tr> <tr> <td style="white-space: nowrap">Host Namespaces</td> <td> <p>Sharing the host namespaces must be disallowed.</p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.hostNetwork</code></li> <li><code>spec.hostPID</code></li> <li><code>spec.hostIPC</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>false</code></li> </ul> </td> </tr> <tr> <td style="white-space: nowrap">Privileged Containers</td> <td> <p>Privileged Pods disable most security mechanisms and must be disallowed.</p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.containers[*].securityContext.privileged</code></li> <li><code>spec.initContainers[*].securityContext.privileged</code></li> <li><code>spec.ephemeralContainers[*].securityContext.privileged</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>fals …(trimmed)