Pod security admission controller in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Pod Security Admission Controller Modes

Which mode of the Pod Security Admission Controller enforces policies and blocks pods that do not comply?

A Warn mode

B Monitor mode

C Enforce mode

D Audit mode

💡 Hint

Think about which mode actively stops non-compliant pods from running.

Enforce mode blocks pods that violate the security policies, preventing them from being created or updated.

💻 Command Output

intermediate

Pod Security Admission Controller Policy Enforcement Output

What is the output when a pod violates the 'restricted' Pod Security Admission policy in enforce mode?

Kubernetes

kubectl apply -f pod.yaml

A Error from server (Forbidden): error when creating "pod.yaml": admission webhook "podsecurity.k8s.io" denied the request: restricted: forbidden fields present

B Warning: pod "mypod" violates policy but created

C pod "mypod" created with warnings

D pod "mypod" created

💡 Hint

Enforce mode blocks pods and returns an error message.

In enforce mode, the admission controller denies pod creation and returns a forbidden error with details about the violation.

❓ Configuration

advanced

Configuring Pod Security Admission Controller for a Namespace

Which YAML snippet correctly configures the Pod Security Admission Controller to enforce the 'baseline' policy on the namespace 'dev-team'?

A

apiVersion: v1
kind: Namespace
metadata:
  name: dev-team
  annotations:
    pod-security.kubernetes.io/warn: baseline

B

apiVersion: v1
kind: Namespace
metadata:
  name: dev-team
  annotations:
    pod-security.kubernetes.io/enforce: baseline

C

apiVersion: v1
kind: Namespace
metadata:
  name: dev-team
  annotations:
    pod-security.kubernetes.io/enforce: restricted

D

apiVersion: v1
kind: Namespace
metadata:
  name: dev-team
  annotations:
    pod-security.kubernetes.io/audit: baseline

💡 Hint

Enforce annotation applies the policy strictly.

The 'pod-security.kubernetes.io/enforce' annotation with value 'baseline' applies the baseline policy in enforce mode to the namespace.

❓ Troubleshoot

advanced

Diagnosing Pod Creation Failure with Pod Security Admission Controller

A developer reports that their pod creation fails with the message: admission webhook "podsecurity.k8s.io" denied the request: restricted: forbidden fields present. What is the most likely cause?

A The pod spec includes fields disallowed by the 'restricted' Pod Security policy enforced on the namespace.

B The Kubernetes API server is down and cannot process the request.

C The pod YAML file is missing required fields like 'metadata' or 'spec'.

D The user does not have permission to create pods in the cluster.

💡 Hint

Focus on the 'forbidden fields present' part of the error message.

The error indicates the pod spec violates the enforced 'restricted' policy by including disallowed fields such as privileged containers or host networking.

🔀 Workflow

expert

Pod Security Admission Controller Policy Upgrade Workflow

You want to upgrade a namespace from 'baseline' to 'restricted' Pod Security policy without breaking existing workloads. Which sequence of steps is best?

A 2,1,3,4

B 3,1,2,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Think about a safe upgrade path that warns first before enforcing.

First warn to detect violations, fix them, then enforce the policy, and finally clean up the warn annotation.