Enforce Pod Security Standards with Namespace Labels [page]deterministic

tasks

Namespaces can be labeled to enforce the [Pod Security Standards](/docs/concepts/security/pod-security-standards). The three policies [privileged](/docs/concepts/security/pod-security-standards/#privileged), [baseline](/docs/concepts/security/pod-security-standards/#baseline) and [restricted](/docs/concepts/security/pod-security-standards/#restricted) broadly cover the security spectrum and are implemented by the [Pod Security](/docs/concepts/security/pod-security-admission/) [admission controller](#gloss:admission-controller).

Pod Security Admission was available by default in Kubernetes v1.23, as a beta. From version 1.25 onwards, Pod Security Admission is generally available.

## Requiring the `baseline` Pod Security Standard with namespace labels

This manifest defines a Namespace `my-baseline-namespace` that:

_Blocks_ any pods that don't satisfy the `baseline` policy requirements.
Generates a user-facing warning and adds an audit annotation to any created pod that does not meet the `restricted` policy requirements.
Pins the versions of the `baseline` and `restricted` policies to v.

```yaml apiVersion: v1 kind: Namespace metadata: name: my-baseline-namespace labels: pod-security.kubernetes.io/enforce: baseline pod-security.kubernetes.io/enforce-version: v

# We are setting these to our _desired_ `enforce` level. pod-security.kubernetes.io/audit: restricted pod-security.kubernetes.io/audit-version: v pod-security.kubernetes.io/warn: restricted pod-security.kubernetes.io/warn-version: v ```

## Add labels to existing namespaces with `kubectl label`

> Note: When an `enforce` policy (or version) label is added or changed, the admission plugin will test each pod in the namespace against the new policy. Violations are returned to the user as warnings.

It is helpful to apply the `--dry-run` flag when initially evaluating security profile changes for namespaces. The Pod Security Standard checks will still be run in _dry run_ mode, giving you information about how the new policy would treat existing pods, without actually updating a policy.

```shell kubectl label --dry-run=server --overwrite ns --all \ pod-security.kubernetes.io/enforce=baseline ```

### Applying to all namespaces

If you're just getting started with the Pod Security Standards, a suitable first step would be to configure all namespaces with audit annotations for a stricter level such as `baseline`:

```shell kubectl label --overwrite ns --all \ pod-security.kubernetes.io/audit=baseline \ pod-security.kubernetes.io/warn=baseline ```

Note that this is not setting an enforce level, so that namespaces that haven't been explicitly evaluated can be distinguished. You can list namespaces without an explicitly set enforce level using this command:

```shell kubectl get namespaces --selector='!pod-security.kubernetes.io/enforce' ```

### Applying to a single namespace

You can update a specific namespace as well. This command adds the `enforce=restricted` policy to `my-existing-namespace`, pinning the restricted policy version to v.

```shell kubectl label --overwrite ns my-existing-namespace \ pod-security.kubernetes.io/enforce=restricted \ pod-security.kubernetes.io/enforce-version=v ```

Sources

tasks/configure-pod-container/enforce-standards-namespace-labels.md · doc — “Enforce Pod Security Standards with Namespace Labels”

Related (7)

references Admission Controller — admission controller conf=1

part_of {{% heading "prerequisites" %}} — describes conf=1

part_of Requiring the `baseline` Pod Security Standard with namespace labels — describes conf=1

part_of Add labels to existing namespaces with `kubectl label` — describes conf=1

part_of Applying to all namespaces — describes conf=1

part_of Applying to a single namespace — describes conf=1

api_for Namespace — documents API object conf=1

← all Docs