Mapping PodSecurityPolicies to Pod Security Standards [page]deterministic
The tables below enumerate the configuration parameters on `PodSecurityPolicy` objects, whether the field mutates and/or validates pods, and how the configuration values map to the [Pod Security Standards](/docs/concepts/security/pod-security-standards/).
For each applicable parameter, the allowed values for the [Baseline](/docs/concepts/security/pod-security-standards/#baseline) and [Restricted](/docs/concepts/security/pod-security-standards/#restricted) profiles are listed. Anything outside the allowed values for those profiles would fall under the [Privileged](/docs/concepts/security/pod-security-standards/#privileged) profile. "No opinion" means all values are allowed under all Pod Security Standards.
For a step-by-step migration guide, see [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/).
## PodSecurityPolicy Spec
The fields enumerated in this table are part of the `PodSecurityPolicySpec`, which is specified under the `.spec` field path.
<table class="no-word-break"> <caption style="display:none">Mapping PodSecurityPolicySpec fields to Pod Security Standards</caption> <tbody> <tr> <th><code>PodSecurityPolicySpec</code></th> <th>Type</th> <th>Pod Security Standards Equivalent</th> </tr> <tr> <td><code>privileged</code></td> <td>Validating</td> <td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td> </tr> <tr> <td><code>defaultAddCapabilities</code></td> <td>Mutating & Validating</td> <td>Requirements match <code>allowedCapabilities</code> below.</td> </tr> <tr> <td><code>allowedCapabilities</code></td> <td>Validating</td> <td> <p><b>Baseline</b>: subset of</p> <ul> <li><code>AUDIT_WRITE</code></li> <li><code>CHOWN</code></li> <li><code>DAC_OVERRIDE</code></li> <li><code>FOWNER</code></li> <li><code>FSETID</code></li> <li><code>KILL</code></li> <li><code>MKNOD</code></li> <li><code>NET_BIND_SERVICE</code></li> <li><code>SETFCAP</code></li> <li><code>SETGID</code></li> <li><code>SETPCAP</code></li> <li><code>SETUID</code></li> <li><code>SYS_CHROOT</code></li> </ul> <p><b>Restricted</b>: empty / undefined / nil OR a list containing <i>only</i> <code>NET_BIND_SERVICE</code> </td> </tr> <tr> <td><code>requiredDropCapabilities</code></td> <td>Mutating & Validating</td> <td> <p><b>Baseline</b>: no opinion</p> <p><b>Restricted</b>: must include <code>ALL</code></p> </td> </tr> <tr> <td><code>volumes</code></td> <td>Validating</td> <td> <p><b>Baseline</b>: anything except</p> <ul> <li><code>hostPath</code></li> <li><code>*</code></li> </ul> <p><b>Restricted</b>: subset of</p> <ul> <li><code>configMap</code></li> <li><code>csi</code></li> <li><code>downwardAPI</code></li> <li><code>emptyDir</code></li> <li><code>ephemeral</code></li> <li><code>persistentVolumeClaim</code></li> <li><code>projected</code></li> <li><code>secret</code></li> </ul> </td> </tr> <tr> <td><code>hostNetwork</code></td> <td>Validating</td> <td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td> </tr> <tr> <td><code>hostPorts</code></td> <td>Validating</td> <td><b>Baseline & Restricted</b>: undefined / nil / empty</td> </tr> <tr> <td><code>hostPID</code></td> <td>Validating</td> <td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td> </tr> <tr> <td><code>hostIPC</code></td> <td>Validating</td> <td><b>Baseline & Rest …(trimmed)