Enforce the restricted Pod Security Standard

Approach

Label the namespace to enforce restricted (with warn and audit to see violations first), and write pod specs that comply.

Solution

apiVersion: v1
kind: Namespace
metadata:
  name: shop
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

apiVersion: v1
kind: Pod
metadata: {name: compliant}
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    seccompProfile: {type: RuntimeDefault}
  containers:
    - name: app
      image: ghcr.io/acme/api:1.4.2
      securityContext:
        allowPrivilegeEscalation: false
        capabilities: {drop: [ALL]}

Pitfalls

• Images that need root or write to /; fix the image (non-root user, writable volumes).
• Enforcing on existing namespaces without a warn period.

Variations

• Pin the policy version (enforce-version: v1.37) for predictable upgrades.
• Kyverno or Gatekeeper for rules beyond the standards (allowed registries, required labels).

Further reading: Pod Security Admission