Mapping PodSecurityPolicies to Pod Security Standards

Mapping PodSecurityPolicies to Pod Security Standards

The tables below enumerate the configuration parameters on PodSecurityPolicy objects, whether the field mutates and/or validates pods, and how the configuration values map to the Pod Security Standards.

For each applicable parameter, the allowed values for the Baseline and Restricted profiles are listed. Anything outside the allowed values for those profiles would fall under the Privileged profile. "No opinion" means all values are allowed under all Pod Security Standards.

For a step-by-step migration guide, see Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller.

PodSecurityPolicy Spec

The fields enumerated in this table are part of the PodSecurityPolicySpec, which is specified under the .spec field path.

Mapping PodSecurityPolicySpec fields to Pod Security StandardsPodSecurityPolicySpecTypePod Security Standards EquivalentprivilegedValidatingBaseline & Restricted: false / undefined / nildefaultAddCapabilitiesMutating & ValidatingRequirements match allowedCapabilities below.allowedCapabilitiesValidating

Baseline: subset of

Restricted: empty / undefined / nil OR a list containing only NET_BIND_SERVICErequiredDropCapabilitiesMutating & Validating

Baseline: no opinion

Restricted: must include ALL

volumesValidating

Baseline: anything except

Restricted: subset of

hostNetworkValidatingBaseline & Restricted: false / undefined / nilhostPortsValidatingBaseline & Restricted: undefined / nil / emptyhostPIDValidatingBaseline & Restricted: false / undefined / nilhostIPCValidatingBaseline & Restricted: false / undefined / nilseLinuxMutating & Validating

Baseline & Restricted: seLinux.rule is MustRunAs, with the following options

runAsUserMutating & Validating

Baseline: Anything

Restricted: rule is MustRunAsNonRoot

runAsGroupMutating (MustRunAs) & ValidatingNo opinionsupplementalGroupsMutating & ValidatingNo opinionfsGroupMutating & ValidatingNo opinionreadOnlyRootFilesystemMutating & ValidatingNo opiniondefaultAllowPrivilegeEscalationMutatingNo opinion (non-validating)allowPrivilegeEscalationMutating & Validating

Only mutating if set to false

Baseline: No opinion

Restricted: false

allowedHostPathsValidatingNo opinion (volumes takes precedence)allowedFlexVolumesValidatingNo opinion (volumes takes precedence)allowedCSIDriversValidatingNo opinion (volumes takes precedence)allowedUnsafeSysctlsValidatingBaseline & Restricted: undefined / nil / emptyforbiddenSysctlsValidatingNo opinionallowedProcMountTypes
(alpha feature)ValidatingBaseline & Restricted: ["Default"] OR undefined / nil / emptyruntimeClass
 .defaultRuntimeClassNameMutatingNo opinionruntimeClass
 .allowedRuntimeClassNamesValidatingNo opinion

PodSecurityPolicy annotations

The annotations enumerated in this table can be specified under .metadata.annotations on the PodSecurityPolicy object.

Mapping PodSecurityPolicy annotations to Pod Security Standards
PSP AnnotationTypePod Security Standards Equivalent
seccomp.security.alpha.kubernetes.io
/defaultProfileName		MutatingNo opinion
seccomp.security.alpha.kubernetes.io
/allowedProfileNames		Validating

Baseline: "runtime/default," (Trailing comma to allow unset)

Restricted: "runtime/default" (No trailing comma)

localhost/* values are also permitted for both Baseline & Restricted.

apparmor.security.beta.kubernetes.io
/defaultProfileName		MutatingNo opinion
apparmor.security.beta.kubernetes.io
/allowedProfileNames		Validating

Baseline: "runtime/default," (Trailing comma to allow unset)

Restricted: "runtime/default" (No trailing comma)

localhost/* values are also permitted for both Baseline & Restricted.

Last modified July 23, 2024 at 12:19 PM PST: PSS: add container_engine_t to allowed list of selinux types (06aff012a2)