Secure Containers Deployments: Time for Refresh
summary
PSP is deprecated and replaced by three Pod Security Standards (privileged, baseline, restricted), enforced via admission controllers; use the restricted profile by default to block root, privilege escalation, and risky volumes. Implementations use OPA/Gatekeeper or Kyverno and can be wired into GitOps (Argo CD) so policies deploy with manifests. Adding a mutating webhook lets the cluster auto-fix manifests instead of hard-rejecting them. Namespace-only scope and lack of per-pod selectors remain practical limitations.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:15Ariels background
- 1:56Pod security
- 3:27SP structure
- 3:37Policy
- 5:28Why is MSP deprecated
- 5:46Challenges with MSP
- 6:44MSP is deprecated
- 7:02New security model
- 8:13Security standards
- 8:49Recommendation
- 10:14Admission Controller
- 11:39Validate
- 12:26Admission Controllers
- 12:40Open Policy Agent
- 14:23Implementation
- 18:26Automation
- 20:52Summary
related talks
40mKubernetes Security After Pod Security Policies Removal
36mKubernetes Security After Pod Security Policies Removal
35mPSP is Dead, Long Live PodSecurity
24mSecure Pods
35mMigrating From PodSecurityPolicy
30mPod Security as an Afterthought
23mSecurity in a containerized world
26mReplacing PSPs? Keep Bad Pods out of your cluster using Kyverno!