Given a namespace labeled with pod-security.kubernetes.io/enforce=restricted, what will happen if a pod with a privileged container is created in that namespace?
medium📝 Command Output Q4 of 15
Kubernetes - RBAC and Security
Given a namespace labeled with pod-security.kubernetes.io/enforce=restricted, what will happen if a pod with a privileged container is created in that namespace?
AThe pod will be created without any restrictions.
BThe pod will be created but a warning will be logged.
CThe pod will be scheduled but evicted immediately.
DThe pod creation will be blocked by the Pod Security Admission Controller.
Step-by-Step Solution
Solution:
Step 1: Understand the 'restricted' profile effect
The 'restricted' profile forbids privileged containers and other risky settings.
Step 2: Apply admission controller behavior
Since the namespace enforces 'restricted', the admission controller blocks pods violating this, such as privileged containers.
Final Answer:
Pod creation is blocked due to privileged container in restricted profile. -> Option D
