skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-pod-security-admission-controller

Configure Kubernetes Pod Security Admission to enforce baseline and restricted pod security standards per namespace.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#kubectl#cluster hardening#admission controller#pod security standards#namespace labels#pod security admission
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-pod-security-admission-controller
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-pod-security-admission-controller
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/implementing-pod-security-admission-controller
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-pod-security-admission-controller

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Kubernetes clusters need a built-in way to prevent insecure pods (privileged containers, root users, host namespaces) from being scheduled, especially after PodSecurityPolicy was deprecated. This Skill guides the implementation of the Pod Security Admission controller so namespaces enforce consistent pod security standards.

Core Features & Use Cases

  • Namespace-Level Enforcement: Apply enforce, audit, and warn modes with privileged, baseline, or restricted profiles using namespace labels.
  • Cluster-Wide Defaults: Configure AdmissionConfiguration on kube-apiserver with controlled exemptions for system namespaces.
  • PSP Migration Path: Step-by-step migration from PodSecurityPolicy using dry-run testing and audit-first rollout.
  • Use Case: A platform team hardens a production cluster by labeling the production namespace with restricted enforcement, validating with dry-run, and confirming that a root-running nginx pod is rejected.

Quick Start

Ask the assistant to apply restricted Pod Security Admission enforcement with audit and warn modes to the production namespace and verify it rejects a non-compliant test pod.

Frequently Asked Questions about implementing-pod-security-admission-controller

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable Pod Security Admission on a Kubernetes namespace?▼

Label the namespace with pod-security.kubernetes.io/enforce set to privileged, baseline, or restricted, plus an enforce-version like v1.28. Use kubectl label namespace or define the labels in the Namespace manifest, then verify with kubectl get ns -L pod-security.kubernetes.io/enforce.

What is the difference between baseline and restricted pod security standards?▼

Baseline blocks known privilege escalations such as privileged containers, hostPID, hostIPC, and hostNetwork. Restricted adds requirements for running as non-root, dropping ALL capabilities, seccomp RuntimeDefault, and disallowing privilege escalation.

How do I migrate from PodSecurityPolicy to Pod Security Admission?▼

Audit existing PSPs and their bindings, map each namespace to a PSA profile using dry-run labeling, enable audit and warn modes first, fix reported violations, then set enforce mode. PSA is built into kube-apiserver from Kubernetes v1.25.

Why is Pod Security Admission not blocking violating pods?▼

Only enforce mode rejects pods; audit and warn merely log or warn. Also check for label typos, missing --admission-control-config-file on kube-apiserver, or namespaces listed in the exemptions section of the PodSecurityConfiguration.

Can Pod Security Admission check image contents or root users baked into images?▼

No, PSA evaluates only the pod spec and cannot inspect image contents or verify image provenance. Combine it with Gatekeeper or Kyverno for image-level and custom policy enforcement.

Related Skills

Explore More Software Engineering Skills→
camoneartcamoneart
5

k8s-security-policies

Implement Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC configurations.

Community
Advanced
gke-labsgke-labs
42

review-security-k8s-admission

Analyze Kubernetes admission webhooks and policies for security misconfigurations.

Official
Advanced
rohitg00rohitg00
944

k8s-policy

Enforce and audit Kubernetes policies using Kyverno and Gatekeeper.

Community
Intermediate
adaptive-enforcement-labadaptive-enforcement-lab
3

policy-as-code-template-library

Automate Kubernetes governance and security policy enforcement with Kyverno and OPA templates.

Official
Intermediate