Kubernetes Security After Pod Security Policies Removal
Talkat ContainerCon @ Open Source Summit Europe 2022 · on Thursday, 2022-09-15· at 14:05· Wicklow Hall 1 (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
PSPs are deprecated and removed in Kubernetes 1.25; cluster owners must replace them with either namespace-labelled Pod Security (three profiles: privileged, baseline, restricted, enforce/audit/warn) or external admission controllers for checks PSPs covered. Pod Security is simple, pod-only and non-mutating; it blocks hostPorts and some fields that may force app changes. Practical replacement shown using Kubewarden (WASM policies, kwctl) plus an Appvia one‑liner that converts existing PSPs into Kubewarden policies; mutating webhooks can still inject defaults like CAP_CHOWN.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:08Security in the Cluster
- 16:14Set Defaults for Port Security
- 18:40Recap
- 19:28Downside of Pod Security
- 29:28Create the Policy
- 36:01Verify Container Images
- 38:04Admission Policy
related talks
36mKubernetes Security After Pod Security Policies Removal
35mMigrating From PodSecurityPolicy
35mPSP is Dead, Long Live PodSecurity
41mUsing Pod Security Policies to harden your Kubernetes cluster
37mHandsOn PodSecurity Policies
35mPodSecurityPolicy Replacement: Past, Present, and Future
26mSecure Containers Deployments: Time for Refresh
26mReplacing PSPs? Keep Bad Pods out of your cluster using Kyverno!