Exercise: restricted PSA, and why one Pod is rejected

Host: controlplane · Time: 9 min · Domain: Minimize Microservice Vulnerabilities

Task

• Namespace locked must enforce the restricted Pod Security Standard.
• Deployments good and bad are provided. bad is rejected; make it compliant without deleting the Deployment.

Acceptance criteria

• kubectl get ns locked --show-labels shows pod-security.kubernetes.io/enforce=restricted.
• kubectl run nginx --image=nginx -n locked is refused.
• Deployment bad has 1 ready replica.

Solution

kubectl label ns locked pod-security.kubernetes.io/enforce=restricted --overwrite
kubectl apply -f bad.yaml --dry-run=server     # read the exact violations

spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
        runAsGroup: 3000
        seccompProfile: {type: RuntimeDefault}
      containers:
      - name: bad
        image: nginxinc/nginx-unprivileged:1.27
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: ["ALL"]}
        volumeMounts:
        - {name: cache, mountPath: /var/cache/nginx}
        - {name: run, mountPath: /var/run}
        - {name: tmp, mountPath: /tmp}
      volumes:
      - {name: cache, emptyDir: {}}
      - {name: run, emptyDir: {}}
      - {name: tmp, emptyDir: {}}

--dry-run=server gives you the four violation lines: those four lines are
the answer.