Pod Security Admission can enforce baseline or restricted Pod Security Standards per namespace. This lab labels a namespace for restricted enforcement and deploys a workload that runs non-root with no added capabilities or privilege escalation.
1. Prepare and execute
Confirm the active kubeconfig context and namespace before applying changes. Save commands and manifests in version control without credentials.
kubectl create namespace restricted-demo
kubectl label namespace restricted-demo
pod-security.kubernetes.io/enforce=restricted
pod-security.kubernetes.io/enforce-version=latest
pod-security.kubernetes.io/audit=restricted
pod-security.kubernetes.io/warn=restricted
2. Declarative configuration
Save the following example in a clearly named YAML file, review it, then use server-side dry-run when the API is available.
apiVersion: v1
kind: Pod
metadata: {name: secure-web, namespace: restricted-demo}
spec:
securityContext:
runAsNonRoot: true
seccompProfile: {type: RuntimeDefault}
containers:
- name: web
image: nginxinc/nginx-unprivileged:1.28-alpine
securityContext:
allowPrivilegeEscalation: false
capabilities: {drop: [ALL]}
ports: [{containerPort: 8080}]
3. Verify the result
A successful command is not enough. Inspect resource state, conditions, events, endpoints, logs, and an end-to-end request where applicable.
kubectl apply --dry-run=server -f secure-pod.yaml
kubectl apply -f secure-pod.yaml
kubectl -n restricted-demo wait --for=condition=Ready pod/secure-web --timeout=90s
kubectl -n restricted-demo exec secure-web -- id
kubectl -n restricted-demo get pod secure-web -o jsonpath='{.spec.securityContext.seccompProfile.type}'
4. Troubleshooting
Admission errors name the restricted field that failed. Fix the image or security context rather than weakening the namespace globally. Restricted policy does not replace RBAC, NetworkPolicy, image controls, or runtime monitoring.
5. Rollback and cleanup
Review the exact target before deleting resources, especially namespaces, claims, Secrets, and cluster-wide add-ons.
kubectl delete namespace restricted-demo
Production checklist
- The active context, namespace, and target version were verified.
- Manifests passed client or server-side validation.
- Resource conditions and recent events show no unresolved error.
- Access, network exposure, resource limits, persistence, and rollback were reviewed.
- Commands and expected output were recorded for the operating team.
References: topic documentation and Kubernetes documentation.
