Overview:

Pod Security Policies (PSPs) and admission controllers define constraints on Pod behavior to enhance security.

Example Pod Security Policy:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  fsGroup:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  volumes:
  - 'configMap'

Steps:

1. Enable the PSP admission controller:

   --enable-admission-plugins=PodSecurityPolicy

2. Apply the PSP:

   kubectl apply -f psp-restricted.yaml

3. Assign the policy to a Role or ClusterRole.

Activity:

Create and enforce a Pod Security Policy to prevent privileged Pod execution.