Pod Security Standards Baseline

Pod Security Standards — Enforced, Not Just Recommended

PodSecurityPolicy is gone. Pod Security Standards are the replacement, and setting them up correctly requires understanding which labels to apply, what audit logging looks like, and how to migrate workloads without breaking anything.

What is Included

• Namespace label manifests for enforce, audit, and warn modes across all three policy levels (privileged, baseline, restricted)
• Audit logging configuration to surface violations without blocking deployments
• Migration guide from PodSecurityPolicy: common patterns and their PSS equivalents
• Example pod specs that pass each security level

Developer Experience

Apply the manifests to enforce the right policy level per namespace. Audit mode first — see what would be blocked before flipping to enforce. Migration guide maps the PSP patterns your team is probably using to their PSS counterparts.

What You Get

• manifests/ — namespace label configs for each mode and level combination
• audit/ — audit policy configuration for violation logging
• examples/ — compliant pod specs at each security level
• migration-guide.md — PSP to PSS translation reference

Requirements

• Kubernetes >= 1.23 (PSS enforced natively)
• kubectl configured with cluster-admin access