Pod security standards in Kubernetes - Step-by-Step Execution

Process Flow - Pod security standards

Pod Creation Request

↓

Check Pod Security Standards

↓

Pass

↓

Pod Runs

When a pod is created, Kubernetes checks its security settings against defined standards. If it passes, the pod runs; if not, it is rejected or warned.

Execution Sample

Kubernetes

apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false

This YAML defines a Pod Security Policy that disallows privileged pods.

Process Table

Step	Pod Security Check	Pod Spec Field	Check Result	Action Taken
1	Check privileged flag	privileged: false	Pass	Continue checking
2	Check hostNetwork usage	hostNetwork: false	Pass	Continue checking
3	Check volume types	volumes: emptyDir	Pass	Continue checking
4	Check runAsUser	runAsUser: MustRunAsNonRoot	Pass	Pod allowed
5	Final decision	-	-	Pod runs successfully

💡 All security checks passed, pod is allowed to run

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
privileged	undefined	false	false	false	false	false
hostNetwork	undefined	undefined	false	false	false	false
volumes	undefined	undefined	undefined	emptyDir	emptyDir	emptyDir
runAsUser	undefined	undefined	undefined	undefined	MustRunAsNonRoot	MustRunAsNonRoot
podAllowed	false	false	false	false	true	true

Key Moments - 3 Insights

Why does the pod get rejected if 'privileged' is true?

Because the Pod Security Standard requires 'privileged' to be false for restricted pods, as shown in step 1 of the execution table where 'privileged: false' passes the check.

What happens if the pod uses hostNetwork: true?

The pod fails the security check at step 2 because hostNetwork must be false to meet the standard, preventing the pod from running.

Why is 'runAsUser: MustRunAsNonRoot' important?

It ensures the pod does not run as root, increasing security. Step 4 shows this check passing, allowing the pod to run.

Visual Quiz - 3 Questions

Look at the execution table, what is the result of the privileged flag check at step 1?

A Fail

B Pass

C Skipped

D Warning

💡 Hint

Refer to the 'Check Result' column in row for step 1 in the execution table.

At which step does the pod get allowed to run?

A Step 4

B Step 5

C Step 2

D Step 3

💡 Hint

Look at the 'Action Taken' column to find when 'Pod allowed' appears.

If the pod used 'hostNetwork: true', what would change in the execution table?

A Step 1 would fail the check

B Step 4 would fail the check

C Step 2 would fail the check

D No change, pod still allowed

💡 Hint

Check the 'Pod Spec Field' and 'Check Result' columns for step 2.

Concept Snapshot

Pod Security Standards check pod specs on creation.
Key fields: privileged=false, hostNetwork=false, runAsUser=non-root.
Pods passing all checks are allowed to run.
Pods failing are rejected or warned.
This protects cluster security by enforcing safe defaults.

Full Transcript

Pod security standards in Kubernetes ensure pods meet security rules before running. When a pod is created, Kubernetes checks fields like 'privileged', 'hostNetwork', and 'runAsUser'. If all checks pass, the pod runs. If any check fails, the pod is rejected or warned. For example, privileged mode must be false to prevent pods from having too many permissions. Host network usage is also restricted. Running as non-root user is enforced. These checks protect the cluster from unsafe pod configurations.