Pod security standards in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Pod Security Standards Levels

Which of the following best describes the restricted Pod Security Standard level in Kubernetes?

A Allows all privileges and capabilities, suitable for trusted workloads.

B Allows some privileges but restricts host networking and volume types.

C Only restricts container image sources but allows all capabilities.

D Disallows privileged containers and host namespaces, enforcing strict security.

💡 Hint

Think about the strictest security level that blocks privileged access.

The restricted level enforces the highest security by disallowing privileged containers and host namespaces, ensuring minimal risk.

💻 Command Output

intermediate

Output of Applying a Pod Security Admission Label

What is the output when you run the following command to label a namespace for the baseline Pod Security Standard enforcement?

kubectl label namespace dev pod-security.kubernetes.io/enforce=baseline

A Error from server (NotFound): namespaces "dev" not found

B namespace/dev labeled

C Warning: label pod-security.kubernetes.io/enforce already exists

D No resources labeled

💡 Hint

Check if the namespace exists before labeling.

If the namespace 'dev' exists, the command labels it and outputs 'namespace/dev labeled'.

❓ Configuration

advanced

Correct Pod Security Admission Configuration in Namespace YAML

Which snippet correctly configures a namespace YAML manifest to enforce the restricted Pod Security Standard at the enforce level?

A

metadata:
  name: secure-ns
  annotations:
    pod-security.kubernetes.io/enforce-level: restricted

B

metadata:
  name: secure-ns
  labels:
    pod-security.kubernetes.io/enforce-level: restricted

C

metadata:
  name: secure-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted

D

metadata:
  name: secure-ns
  annotations:
    pod-security.kubernetes.io/enforce: restricted

💡 Hint

Pod Security Admission uses labels, not annotations, for enforcement.

The correct way is to use the label 'pod-security.kubernetes.io/enforce' with the value 'restricted' under metadata.labels.

❓ Troubleshoot

advanced

Troubleshooting Pod Creation Failure Due to Pod Security Admission

A developer tries to create a pod in a namespace labeled with pod-security.kubernetes.io/enforce=restricted but gets an error. Which of the following pod specs is most likely causing the failure?

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      privileged: true

A The pod uses a privileged container which is disallowed by the restricted policy.

B The pod image nginx is not allowed in restricted mode.

C The pod lacks resource limits causing the failure.

D The pod is missing a service account annotation.

💡 Hint

Restricted policy blocks privileged containers.

The restricted Pod Security Standard disallows privileged containers, so setting privileged: true causes rejection.

✅ Best Practice

expert

Best Practice for Gradual Pod Security Standard Adoption

You want to gradually enforce Pod Security Standards in a large cluster without breaking existing workloads immediately. Which approach is best?

A Use <code>pod-security.kubernetes.io/warn=baseline</code> labels first to audit violations before enforcing.

B Label all namespaces with <code>pod-security.kubernetes.io/enforce=restricted</code> at once.

C Remove all Pod Security Admission controllers to avoid enforcement issues.

D Manually edit each pod to comply before applying any namespace labels.

💡 Hint

Start by warning to identify issues before blocking pods.

Using the warn label allows you to see policy violations without blocking pod creation, enabling gradual adoption.