#pod security

Kubernetes Pod Security Admission Rollout Planner: Namespace Labels for Baseline and Restricted, Audit and Warn First, Dry-Run Checks, securityContext Fixes, and Exemption Rules

Plan a Pod Security Admission rollout for a Kubernetes cluster: pick baseline or restricted per namespace, roll out with warn and audit labels before enforce, run server side dry-run label checks, fix workload securityContext fields to pass restricted, and keep exemptions narrow and documented.

Act as a Kubernetes platform engineer who rolls out Pod Security Admission (PSA) across clusters after the removal of PodSecurityPolicy in Kubernetes 1.25, without breaking running workloads. Inputs: - Cluster details: Kubernetes version, distribution (EKS, GKE, AKS, on prem), and whether a policy engine like Kyverno or Gatekeeper is also running: [ClusterInfo] - Namespaces with owner team and workload types (web apps, jobs, DaemonSets, operators, CI runners): [NamespaceList] - Current warnings or violations, pasted from kubectl label dry-run output or audit logs: [CurrentViolations] - Workload specs or securityContext snippets that fail today: [WorkloadSpecs] - Exceptions the team believes it needs (privileged agents, host networking, CNI or CSI drivers): [ExceptionRequests] - Rollout window and change process: [RolloutWindow] - Output format: [Format] Generate: 1. A target level per namespace from NamespaceList: privileged, baseline, or restricted, with the reason, and pod-security.kubernetes.io version labels pinned to the cluster minor version from ClusterInfo. 2. A phased label plan: warn and audit at the target level first, enforce later, with the exact kubectl label commands per phase. 3. Dry-run checks: kubectl label --dry-run=server --overwrite commands per namespace and how to read the warnings in CurrentViolations. 4. securityContext fixes for each spec in WorkloadSpecs to meet restricted: runAsNonRoot, allowPrivilegeEscalation false, capabilities drop ALL, seccompProfile RuntimeDefault, and no hostPath or host namespaces, as YAML patches. 5. An exemption plan from ExceptionRequests: keep system agents in a namespace labeled privileged, or use the AdmissionConfiguration exemptions (usernames, runtimeClasses, namespaces) only where the distribution allows it, each with an owner and review date. 6. A rollout calendar inside RolloutWindow with a rollback step (remove or relax the enforce label). 7. A check for overlap with any policy engine in ClusterInfo so rules do not conflict. Constraints: - Use only namespaces, specs, and violations in the inputs; do not invent workload names. - Never move a namespace to enforce before its warnings are cleared or exempted. - Keep YAML valid and minimal. No em dashes.