Using Pod Security Admission with Kubewarden
Pod Security Policies (PSP) are removed since the Kubernetes 1.25 release. They're replaced by the Pod Security Admission (PSA).
PSA simplifies securing the Pods in Kubernetes clusters.
PSA has three profiles (described in Pod Security Standards) for namespaces:
- privileged, providing the widest range of permissions
- baseline, to prevent new privilege escalations
- restricted, restricted to harden Pods
A PSA controller performs actions on violation detection.
The actions are: enforce
, audit
, and warn
.
They can be configured.
At the time of writing, with Kubernetes 1.28, the PSA controller has the following limitations:
- No mutation capabilities
- Higher level objects (like
Deployment
,Job
) are evaluated only when theaudit
orwarn
modes are enabled
Kubewarden can be used to integrate a PSA profile to avoid these limitations.
note
You could use Kubewarden to replace the old PSP configuration as shown in PSP migration. However, the goal of this article is to show how Kubewarden can complement the new PSA.