Example Documentation: Pod Security Admission
Goal
Trace Pod Security Admission with a restricted namespace and both allowed and risky Pods.
What Is Done
The lab sets namespace labels for restricted, creates an allowed Pod and includes an intentionally risky Pod with privileged and hostNetwork.
Typical Commands
kubectl apply -f manifests/00-namespace.yaml
kubectl apply -f manifests/10-allowed-pod.yaml
kubectl apply -f manifests/90-denied-pod.yaml
kubectl get events -n psa-lab --sort-by=.lastTimestamp
Validate Success
- The allowed Pod is accepted.
- The risky Pod is rejected or produces clear warnings.
- Namespace labels include
pod-security.kubernetes.io/enforce: restricted.
Common Mistakes
- The cluster uses older Kubernetes versions without Pod Security Admission.
- Warnings are missed because only exit codes are checked.
- SecurityContext is checked only on the container, not on the Pod.