Pod security standards in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the Pod Security Standard level in the namespace annotation.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: secure-namespace
  annotations:
    pod-security.kubernetes.io/enforce: [1]

Drag options to blanks, or click blank then click option'

Arestricted

Bprivileged

Cbaseline

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'privileged' which allows more permissions than desired.

The restricted level enforces the highest security standards for pods in the namespace.

2fill in blank

medium

Complete the code to set the audit level for Pod Security Standards in the namespace annotation.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: audit-namespace
  annotations:
    pod-security.kubernetes.io/audit: [1]

Drag options to blanks, or click blank then click option'

Arestricted

Bnone

Cprivileged

Dbaseline

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'privileged' which is too permissive for audit.

The restricted audit level logs violations of the strictest Pod Security Standards.

3fill in blank

hard

Fix the error in the Pod Security Standard annotation key to enforce the baseline policy.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-namespace
  annotations:
    pod-security.kubernetes.io/enforce: [1]

Drag options to blanks, or click blank then click option'

Aprivileged

Brestricted

Cbaseline

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect annotation keys like 'enforce-baseline'.

The correct annotation key is pod-security.kubernetes.io/enforce with the value baseline. The given key is incorrect.

4fill in blank

hard

Fill both blanks to set the enforce and warn levels for Pod Security Standards in a namespace.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: mixed-namespace
  annotations:
    pod-security.kubernetes.io/enforce: [1]
    pod-security.kubernetes.io/warn: [2]

Drag options to blanks, or click blank then click option'

Arestricted

Bbaseline

Cprivileged

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Setting both enforce and warn to the same level.

The enforce annotation should be set to restricted for strict enforcement, while the warn annotation can be set to baseline to warn about less strict policy violations.

5fill in blank

hard

Fill all three blanks to create a Pod Security Standard policy with enforce, warn, and audit levels.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: full-policy-namespace
  annotations:
    pod-security.kubernetes.io/enforce: [1]
    pod-security.kubernetes.io/warn: [2]
    pod-security.kubernetes.io/audit: [3]

Drag options to blanks, or click blank then click option'

Arestricted

Bbaseline

Cprivileged

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up the order of enforce, warn, and audit levels.

This configuration enforces the restricted level, warns at the baseline level, and audits the privileged level.