Guide to Securing Containers with Kubernetes Pod Security Policies

Kubernetes has transformed how applications are deployed at scale using containers. However, security concerns often arise as container sprawl increases. Pod Security Policies (PSPs) provide a critical layer of defense to enforce security standards on pods running in your clusters.

What Are Kubernetes Pod Security Policies?

PSPs are cluster-level resources that define a set of conditions a pod must meet to be accepted into the system. These policies can restrict actions like privilege escalation, running as root, usage of host namespaces, and volume types, helping to minimize security risks.

Prerequisites

A Kubernetes cluster with version 1.21 or earlier (PSPs are deprecated in newer versions, but alternatives are in place)
kubectl command-line tool configured with cluster access
Basic understanding of Kubernetes pods and RBAC

How to Create and Apply a Pod Security Policy

Follow these steps to implement a sample Pod Security Policy that restricts privilege escalation and running of privileged containers.

Step 1: Define the Pod Security Policy YAML

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'secret'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: false

Step 2: Apply the Pod Security Policy

Run the following command to create the PSP in your cluster:

kubectl apply -f restricted-psp.yaml

Step 3: Bind the PSP to Service Accounts

Configure RBAC to allow users or service accounts to use this PSP:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: psp-user
  namespace: default
rules:
- apiGroups:
  - policy
  resourceNames:
  - restricted-psp
  resources:
  - podsecuritypolicies
  verbs:
  - use

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: use-restricted-psp
  namespace: default
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
roleRef:
  kind: Role
  name: psp-user
  apiGroup: rbac.authorization.k8s.io

Troubleshooting

If pods fail to schedule, check if the service account has permission to use the PSP.
Use kubectl describe pod <pod-name> to understand permission errors related to PSP.
Verify your cluster supports PSPs, or use newer alternatives like OPA Gatekeeper or the Pod Security Admission controller.

Summary Checklist

Verify cluster Kubernetes version compatibility with PSP.
Create Pod Security Policy YAML defining secure pod constraints.
Apply PSP YAML to your cluster.
Set appropriate RBAC roles and bindings for PSP usage.
Test pod deployments to confirm policy enforcement.
Monitor and troubleshoot permission issues with pod events.

For more on Kubernetes security best practices, see our post on How to Securely Set Up IoT Devices on Your Network, which shares important principles applicable across cloud environments.

Implementing Pod Security Policies is a vital step to harden container deployments in Kubernetes. As security remains a continuous journey, regularly update policies as your architecture and threat landscape evolve.

For deeper Kubernetes security insights and updates, always check the official Kubernetes Pod Security Policy documentation (Official site).