Pod security standard

Supported Configurations

Running the control plane as a container with:

• Shared Nodes

note

This feature is disabled by default.

Pod security standards prevent Pods from starting if they request permissions beyond what's allowed. These standards check settings like spec.securityContext, host ports, volume types, and AppArmor annotations.

Enable this feature to block privileged Pods from escaping the tenant cluster.

policies:
  podSecurityStandard: <policy_profile>

• Replace <policy_profile> with privileged, baseline, or restricted.

See the Kubernetes Pod Security profile details for more information.

What this validates

Pod Security Standards evaluate the Pod spec: fields like spec.securityContext, host ports, volume types, and AppArmor annotations. They don't inspect the backing source of a PersistentVolumeClaim's volume. They also don't validate a host-side Pod that a controller such as KubeVirt generates from a tenant custom resource. On shared nodes, prefer restricted over baseline, and pair this with the additional controls in the shared-node hardening guide.

Config reference

podSecurityStandard string

PodSecurityStandard that can be enforced can be one of: empty (""), baseline, restricted or privileged