Kubernetes v1.25 - Pod Security Admission Control - PodSecurityPolicy Successor

Kubernetes v1.25 - Pod Security Admission Control - PodSecurityPolicy Successor

Also will be part of the feature CKS exams

Chapers
00:00 About the topic
00:11 PodSecurityPolicy Depreciation
01:02 PodSecurity Admission Intro
02:37 Admission Controllers Recap
03:51 PodSecurity Admission in short
06:25 How to enable PodSecurity Admission
08:35 PodSecurity Levels
11:30 PodSecurity Modes
13:41 PodSecurity Admission Steps
16:47 PodSecurity Admission Labels at Namespace Level
18:53 PodSecurity Admission Labels at Cluster Level
19:55 PodSecurity Admission Exemptions
21:45 PodSecurity Commands
22:51 PodSecurity Demo
43:56 PodSecurity Alternates

YAML files:

Pod Security Admission Github enhancement:

Like, Comment & Subscribe Learn with GVR

#cks #kubenetes #kubernetessecurity #k8s #learnwithgvr

[aireddy]

Very detailed explanation about PodSecurity admission controller. This session is very helpful, Ramana.

[mpandu]

Thank you so much for detailed explanation. Its really helpful

[MrWarious]

Hi Ramanan, thank you! Really helpful explanation.

[Ravi-grqn]

Hey, thanks for the session and CKS playlist. Can you also share a video about your kube setup?

[saiprasanna]

Can we have custom Pod Security Standards?

[iammrchetan]

Hi @Learn With GVR,

I want to restrict users from running cp/scp/rsync/sftp commands inside the containers running in the kubernetes. I understand that we should only have needed packages available inside the application images. But in our system, lots of applications are already running and we can't control that as of now. I was wondering if we have a way to achieve the same by using PodSecurityPolicy or PodSecurity admission controller. Let me know your thoughts around the same.

[MOHAMMEDAHMEDMUDASSIR]

IS THIS THE COMPLETE TRAINING PLAYLIST ON KUBERNETES SECURITY ?

[KaranKumar-hyve]

Thanks Ramana, a very good session, Just one question, if we enable PSA at cluster level, will it add the labels to the namespaces automatically ?

[qqq]

Thank you for your explanation. I have one practical question.

From my understanding, in the pod security admission(PSA), there is no customization feature. We can only select one of the security levels (privileged, baseline or restricted)

Now, there is a pod which uses capability CAP_NET_ADMIN only. But, the ‘baseline’ level of PSA doesn’t have CAP_NET_ADMIN. As a result, should this pod be created with ‘privileged’ level, even though the pod needs only one capability? (In case I don't use webhook or other tool for it)

[jayeshthamke]

Hey thanks for detailed explanation, I have couple questions:

1. I see that multiple pod-security lables can be applied to a namespace. What will happen if I apply labels with MODE: 'warn' and 'enforce' for PROFILE: 'restricted'. Does it create new baseline security context pod?
What action will be enforced at the end or will there be some conflict?

2. Is kube-system namespace expemted from this change?

[tamilselvan]

Hi Ramanan, Can you please share those yaml files github link which you have shown in this videos?

[shamstabrez]

bro ye video to awesome h no doubt i jst wnna ask u if i want to store my secrets so which one could be the best option aws secrets manager or hashicorp vault accrdng to price n all things

[BVNTKS]

Thank you so much for detailed explanation. Its really helpful.