Lesson 4.8: Pod security
A pod's securityContext and spec decide how much of the node it can touch: privileged mode, host namespaces, hostPath volumes and root users are the Kubernetes versions of the dangerous Docker options from 3.3. Pod Security Standards (privileged, baseline, restricted) define safe profiles, and Pod Security Admission enforces them per namespace with a label. In the lab you find the API pod mounting the node's whole filesystem, turn on the restricted standard for the shop namespace, watch Kubernetes refuse the old manifest with a list of violations, and deploy the compliant version.
18 min
You will learn to
- Explain securityContext settings
- Find privileged pods and hostPath mounts
- Explain the three Pod Security Standards
- Enforce restricted on a namespace
- Write a compliant pod manifest
Key terms
- securityContext
- Pod- and container-level settings for user, privileges, capabilities, seccomp and filesystem.
- hostPath volume
- Mounts a directory of the node into the pod.
- Pod Security Standards
- Three profiles: privileged (no limits), baseline (blocks known escalations), restricted (hardened best practice).
- Pod Security Admission
- Built-in admission controller that applies a standard per namespace via labels: enforce, audit, warn.
- seccomp
- A Linux filter that limits which system calls a process may make; RuntimeDefault is the container runtime's safe profile.
← DNS and beaconing · All lessons · Modes, IVs and authenticated encryption →