← All bundles
</> Policy bundle · Apache-2.0

pod-security-admission

versionv1.36.0-cenroq policies84 bindings252 licenseApache-2.0

Pod Security Standards implemented as Validating Admission Policies, with the same levels (baseline and restricted).

// install

apply the bundle.

$ kubeapt bundles install pod-security-admission

…or download and apply it with kubectl alone:

mkdir -p /tmp/cenroq && curl -L https://github.com/cenroq/kubernetes-security-policies/releases/download/vap_pod-security-admission%40v1.36.0-cenroq/pod-security-admission_v1.36.0-cenroq.tar.gz | tar -xz -C /tmp/cenroq && kubectl apply -f /tmp/cenroq/pod-security-admission/policies.yaml -f /tmp/cenroq/pod-security-admission/bindings.yaml

Archives: pod-security-admission_v1.36.0-cenroq.tar.gz · pod-security-admission_v1.36.0-cenroq.zip

// activation

warn, audit, then enforce.

Nothing is enforced until you label a namespace. Move one namespace at a time, and start with warn.

To exclude a single policy from a mode, label the namespace <policy-name>.pss.security.cenroq.io/warn=disabled.

Deprecated versions: v1.36.0, v1.35.0, v1.34.0.

// contents

84 policies in this bundle.

Each links to its page in the policy catalog.