Pod Security Bindings

Comprehensive reference for all Kubernetes security bindings that control pod behavior, privilege levels, and access controls.

Pod Security Standards

privileged

Unrestricted policy allowing all capabilities and host access for workloads requiring maximum privileges.

privileged-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
  labels:
    pod-security.kubernetes.io/enforce: privileged
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      privileged: true

baseline

Minimally restrictive policy preventing known privilege escalations while allowing common container patterns.

baseline-namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline

restricted

Heavily restricted policy following current pod hardening best practices for security-critical workloads.

restricted-namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

SecurityContext Bindings

runAsUser

Specifies the UID to run container processes, preventing root execution when set to non-zero values.

run-as-user.yaml

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
  containers:
  - name: app
    image: nginx
    securityContext:
      runAsUser: 2000

runAsGroup

Sets the primary GID for all processes in containers, controlling group-level file system access.

run-as-group.yaml

apiVersion: v1
kind: Pod
metadata:
  name: group-context
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
  containers:
  - name: app
    image: nginx

fsGroup

Defines the supplementary group ID for volume ownership, making mounted volumes writable by that group.

fs-group.yaml

apiVersion: v1
kind: Pod
metadata:
  name: fs-group-demo
spec:
  securityContext:
    fsGroup: 2000
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    emptyDir: {}

capabilities (add/drop)

Grants or removes Linux capabilities from containers, allowing fine-grained privilege control beyond root/non-root.

capabilities.yaml

apiVersion: v1
kind: Pod
metadata:
  name: capabilities-demo
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
        - CHOWN

readOnlyRootFilesystem

Forces the container's root filesystem to be read-only, preventing runtime modifications and improving security.

readonly-root.yaml

apiVersion: v1
kind: Pod
metadata:
  name: readonly-root
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
    - name: cache
      mountPath: /var/cache/nginx
  volumes:
  - name: cache
    emptyDir: {}

allowPrivilegeEscalation

Controls whether a process can gain more privileges than its parent, blocking setuid binaries when false.

no-privilege-escalation.yaml

apiVersion: v1
kind: Pod
metadata:
  name: no-escalation
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      allowPrivilegeEscalation: false

privileged

Gives the container root-equivalent access to the host, removing all security boundaries and container isolation.

privileged-container.yaml

apiVersion: v1
kind: Pod
metadata:
  name: privileged-container
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      privileged: true

runAsNonRoot

Enforces that the container must run as a non-root user, failing to start if the image specifies UID 0.

non-root.yaml

apiVersion: v1
kind: Pod
metadata:
  name: non-root
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
  containers:
  - name: app
    image: nginx

seccompProfile

Applies Seccomp (secure computing mode) profiles to restrict system calls available to containers.

seccomp.yaml

apiVersion: v1
kind: Pod
metadata:
  name: seccomp-demo
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: nginx

seLinuxOptions

Configures SELinux labels for containers when SELinux is enabled on the host system.

selinux.yaml

apiVersion: v1
kind: Pod
metadata:
  name: selinux-demo
spec:
  securityContext:
    seLinuxOptions:
      level: "s0:c123,c456"
      role: "spc_t"
      type: "container_t"
      user: "system_u"
  containers:
  - name: app
    image: nginx

windowsOptions

Sets Windows-specific security context including user, group, and credential specs for Windows containers.

windows-options.yaml

apiVersion: v1
kind: Pod
metadata:
  name: windows-demo
spec:
  os:
    name: windows
  securityContext:
    windowsOptions:
      runAsUserName: "ContainerUser"
      gmsaCredentialSpecName: "gmsa-webapp"
  containers:
  - name: app
    image: mcr.microsoft.com/windows/servercore:ltsc2022

Pod Security Admission

enforce

Blocks pod creation if it violates the specified security standard level.

enforce-mode.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: enforce-restricted
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: v1.28

audit

Logs violations to audit logs without blocking pod creation, useful for monitoring compliance.

audit-mode.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: audit-monitoring
  labels:
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/audit-version: latest

warn

Returns warning messages to the user when violations occur but doesn't block or log to audit.

warn-mode.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: warn-namespace
  labels:
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/warn-version: latest

PodSecurityPolicy Bindings (Deprecated)

PodSecurityPolicy was deprecated in Kubernetes v1.21 and removed in v1.25. Use Pod Security Admission instead.

privileged

Determines if pods can run in privileged mode with access to host resources.

psp-privileged.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: privileged-psp
spec:
  privileged: true
  allowPrivilegeEscalation: true
  allowedCapabilities:
  - '*'
  volumes:
  - '*'
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  hostIPC: true
  hostPID: true
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'

allowPrivilegeEscalation

Controls if containers can request privilege escalation through setuid binaries or other means.

psp-no-escalation.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
  - ALL
  volumes:
  - 'configMap'
  - 'emptyDir'
  - 'projected'
  - 'secret'
  - 'downwardAPI'
  - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: true

allowedCapabilities

Whitelist of Linux capabilities that can be added to containers beyond the default set.

psp-capabilities.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: capabilities-psp
spec:
  privileged: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  - CHOWN
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: 'MustRunAsNonRoot'

volumes

Restricts which volume types pods can use, preventing potentially unsafe volume mounts.

psp-volumes.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: volume-restricted
spec:
  volumes:
  - 'configMap'
  - 'emptyDir'
  - 'projected'
  - 'secret'
  - 'downwardAPI'
  - 'persistentVolumeClaim'
  runAsUser:
    rule: 'RunAsAny'

hostNetwork

Allows pods to use the host's network namespace, giving them access to host network interfaces.

psp-host-network.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: host-network
spec:
  hostNetwork: true
  hostPorts:
  - min: 8000
    max: 9000
  runAsUser:
    rule: 'RunAsAny'

hostPID / hostIPC

Permits pods to use the host's PID or IPC namespace, enabling interaction with host processes.

psp-host-namespaces.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: host-namespaces
spec:
  hostPID: true
  hostIPC: true
  runAsUser:
    rule: 'RunAsAny'

runAsUser

Defines constraints on which user IDs containers can run as through MustRunAs, MustRunAsNonRoot, or RunAsAny rules.

psp-run-as-user.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-user
spec:
  runAsUser:
    rule: 'MustRunAsNonRoot'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'

Additional Security Bindings

appArmorProfile

Applies AppArmor profiles to containers for mandatory access control and security policy enforcement.

apparmor.yaml

apiVersion: v1
kind: Pod
metadata:
  name: apparmor-demo
  annotations:
    container.apparmor.security.beta.kubernetes.io/app: runtime/default
spec:
  containers:
  - name: app
    image: nginx

supplementalGroups

Adds additional group IDs to the container process for extended file system access permissions.

supplemental-groups.yaml

apiVersion: v1
kind: Pod
metadata:
  name: supplemental-groups
spec:
  securityContext:
    supplementalGroups: [4000, 5000]
  containers:
  - name: app
    image: nginx

procMount

Controls how /proc is mounted in the container, with "Default" or "Unmasked" options affecting visibility.

proc-mount.yaml

apiVersion: v1
kind: Pod
metadata:
  name: proc-mount
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      procMount: Default

Best Practices

Always drop ALL capabilities and only add specific ones needed
Use runAsNonRoot: true whenever possible to prevent root execution
Enable readOnlyRootFilesystem and mount writable volumes only where needed
Set allowPrivilegeEscalation: false to prevent privilege escalation attacks
Apply the Restricted standard for production workloads when feasible
Use Seccomp RuntimeDefault profile as a baseline security measure
Avoid privileged: true unless absolutely necessary for system-level operations
Implement Pod Security Admission at the namespace level for consistent policy enforcement

Pod Security Standards

privileged

baseline

restricted

SecurityContext Bindings

runAsUser

runAsGroup

fsGroup

capabilities (add/drop)

readOnlyRootFilesystem

allowPrivilegeEscalation

privileged

runAsNonRoot

seccompProfile

seLinuxOptions

windowsOptions

Pod Security Admission

enforce

audit

warn

PodSecurityPolicy Bindings (Deprecated)

privileged

allowPrivilegeEscalation

allowedCapabilities

volumes

hostNetwork

hostPID / hostIPC

runAsUser

Additional Security Bindings

appArmorProfile

supplementalGroups

procMount

Best Practices

References

On this page