skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-kubernetes-pod-security-standards

Configures Kubernetes Pod Security Standards enforcement using namespace labels and the PSA admission controller.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#kubectl#Security#psa#container hardening#pod security standards#namespace labels
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-pod-security-standards
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-kubernetes-pod-security-standards
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/implementing-kubernetes-pod-security-standards
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-pod-security-standards

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hardening Kubernetes workloads against privilege escalation and container breakout requires correctly applying Pod Security Standards, but misconfigured namespace labels, silent label typos, and premature enforcement commonly leave clusters either unprotected or broken. This Skill provides a verified, phased workflow for enforcing Privileged, Baseline, and Restricted profiles via the built-in Pod Security Admission controller.

Core Features & Use Cases

  • Namespace-Level PSA Enforcement: Apply enforce, audit, and warn labels with pinned versions to route workloads into Privileged, Baseline, or Restricted profiles.
  • Restricted-Compliant Pod Specs: Generate hardened Deployment manifests with runAsNonRoot, seccomp, dropped capabilities, and read-only root filesystems.
  • Phased Migration & Dry-Run Verification: Move from audit-only discovery to full enforcement using kubectl dry-run commands that list existing violators before blocking them.
  • Use Case: A platform engineer migrating off deprecated PodSecurityPolicy labels the production namespace with audit/warn restricted, reviews violations, fixes non-compliant deployments, then flips enforce=restricted after confirming a test pod is rejected.

Quick Start

Ask the AI to apply restricted Pod Security Standards enforcement to the production namespace and verify it rejects a privileged test pod.

Frequently Asked Questions about implementing-kubernetes-pod-security-standards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce Pod Security Standards on a Kubernetes namespace?▼

Label the namespace with pod-security.kubernetes.io/enforce set to privileged, baseline, or restricted, optionally pinning enforce-version to a specific release like v1.28. The built-in Pod Security Admission controller then rejects non-compliant pods at creation time.

How to migrate from PodSecurityPolicy to Pod Security Admission?▼

Start in audit and warn mode with the restricted profile to surface violations without blocking workloads, fix non-compliant pod specs, then enable enforce=baseline and finally enforce=restricted. PSA is built into Kubernetes 1.25+ and replaces the removed PodSecurityPolicy.

Why are pods still scheduled despite restricted Pod Security labels?▼

Pods still schedule when only audit or warn labels are set, since those modes log and warn but never block. Confirm the enforce label exists with kubectl get ns -L pod-security.kubernetes.io/enforce, and check for label key typos, which PSA silently ignores.

What is the difference between Baseline and Restricted pod security profiles?▼

Baseline blocks known privilege escalations such as privileged containers, host namespaces, and dangerous capabilities. Restricted adds hardening requirements: runAsNonRoot, dropping ALL capabilities, a seccomp profile, and no privilege escalation.

Can Pod Security Admission detect containers running as root inside images?▼

No, PSA evaluates only the pod spec, not image contents, so a root USER baked into an image or an unsigned image passes undetected. Layer a policy engine like Gatekeeper or Kyverno for image-level checks.

Related Skills

Explore More Software Engineering Skills→
simplerick0simplerick0

kubernetes

Automate Kubernetes cluster provisioning, deployment, scaling, and troubleshooting with kubectl, helm, and kustomize.

Community
Advanced
claude-office-skillsclaude-office-skills
368

Security Monitoring

Automate security monitoring, threat detection, and incident response workflows.

Official
Advanced
NickCrewNickCrew
29

kubernetes-security-policies

Enforce Kubernetes security policies across clusters and namespaces.

Community
Advanced
rohitg00rohitg00
944

k8s-policy

Enforce and audit Kubernetes policies using Kyverno and Gatekeeper.

Community
Intermediate