Migrating From PodSecurityPolicy
summary
Kubernetes removes PodSecurityPolicy in v1.25 and recommends migrating to the built-in Pod Security admission; a fast path uses namespace labels and dry-run/warn modes to flip to PSA baseline enforce and usually just works. Beware mutating PSPs that inject runAsUser=2005 and fsGroup=1005 and can cause real 403 outages when removed. A CLI called PSP migrator detects mutations, suggests the safe profile per namespace and can apply the label. Alternatives include OPA/Gatekeeper, Kyverno, and CEL (API server 1.26).
AI-written summary · about
chapters (11)
- 0:00PSP to PSA transition
- 2:01Fast path migration demo
- 5:54PSA enforcement strategies
- 11:28Migration challenges
- 12:49PSP mutation dangers
- 14:05Handling PSP mutations
- 22:45PSP migrator tool demo
- 26:40Limitations of PSA
- 28:41Alternative admission tools
- 30:43Defense in depth approach
- 32:08Conclusion and Q&A
related talks
40mKubernetes Security After Pod Security Policies Removal
36mKubernetes Security After Pod Security Policies Removal
35mPSP is Dead, Long Live PodSecurity
26mReplacing PSPs? Keep Bad Pods out of your cluster using Kyverno!
35mPodSecurityPolicy Replacement: Past, Present, and Future
41mUsing Pod Security Policies to harden your Kubernetes cluster
26mSecure Containers Deployments: Time for Refresh
33mBringing Pod Security Admission to Your Kubernetes Distribution