⎈ k8s knowledge compiler

Pod Security Standards [page]deterministic

A detailed look at the different policy levels defined in the Pod Security Standards.

conceptssecurity

The Pod Security Standards define three different _policies_ to broadly cover the security spectrum. These policies are _cumulative_ and range from highly-permissive to highly-restrictive. This guide outlines the requirements of each policy.

| Profile | Description | | ------ | ----------- | | <strong style="white-space: nowrap">Privileged</strong> | Unrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations. | | <strong style="white-space: nowrap">Baseline</strong> | Minimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration. | | <strong style="white-space: nowrap">Restricted</strong> | Heavily restricted policy, following current Pod hardening best practices. |

## Profile Details

### Privileged

The _Privileged_ policy is purposely-open, and entirely unrestricted. This type of policy is typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.

The Privileged policy is defined by an absence of restrictions. If you define a Pod where the Privileged security policy applies, the Pod you define is able to bypass typical container isolation mechanisms. For example, you can define a Pod that has access to the node's host network.

### Baseline

**The _Baseline_ policy is aimed at ease of adoption for common containerized workloads while preventing known privilege escalations.** This policy is targeted at application operators and developers of non-critical applications. The following listed controls should be enforced/disallowed:

> Note: In this table, wildcards (`*`) indicate all elements in a list. For example, `spec.containers[*].securityContext` refers to the Security Context object for _all defined containers_. If any of the listed containers fails to meet the requirements, the entire pod will fail validation.

<table> <caption style="display:none">Baseline policy specification</caption> <tbody> <tr> <th>Control</th> <th>Policy</th> </tr> <tr> <td style="white-space: nowrap">HostProcess</td> <td> <p>Windows Pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">HostProcess containers</a> which enables privileged access to the Windows host machine. Privileged access to the host is disallowed in the Baseline policy. </p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.containers[*].securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.initContainers[*].securityContext.windowsOptions.hostProcess</code></li> <li><code>spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>false</code></li> </ul> </td> </tr> <tr> <td style="white-space: nowrap">Host Namespaces</td> <td> <p>Sharing the host namespaces must be disallowed.</p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.hostNetwork</code></li> <li><code>spec.hostPID</code></li> <li><code>spec.hostIPC</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>false</code></li> </ul> </td> </tr> <tr> <td style="white-space: nowrap">Privileged Containers</td> <td> <p>Privileged Pods disable most security mechanisms and must be disallowed.</p> <p><strong>Restricted Fields</strong></p> <ul> <li><code>spec.containers[*].securityContext.privileged</code></li> <li><code>spec.initContainers[*].securityContext.privileged</code></li> <li><code>spec.ephemeralContainers[*].securityContext.privileged</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> <li>Undefined/nil</li> <li><code>fals …(trimmed)

Sources

concepts/security/pod-security-standards.md · docPod Security Standards

Related (14)

part_of Profile Detailsdescribes conf=1
part_of Policy Instantiationdescribes conf=1
part_of Pod OS fielddescribes conf=1
part_of User namespacesdescribes conf=1
part_of FAQdescribes conf=1
part_of Privilegeddescribes conf=1
part_of Baselinedescribes conf=1
part_of Restricteddescribes conf=1
part_of Alternativesdescribes conf=1
part_of Restricted Pod Security Standard changesdescribes conf=1
part_of What about sandboxed Pods?describes conf=1
api_for Poddocuments API object conf=1

← all Docs