Amazon EKS — Pod Security Standards

Pod Security Standards

Pod Security Standards (PSS) define three security levels for pods. They replace the deprecated PodSecurityPolicy and control what containers can and can’t do.

---

Three Security Levels

Level	Description	Use Case
Privileged	No restrictions	System-level pods (CNI, storage drivers)
Baseline	Prevents known privilege escalations	Default for most workloads
Restricted	Maximum security	Sensitive workloads, compliance

---

What Each Level Restricts

Control	Privileged	Baseline	Restricted
Privileged containers	✅ Allowed	❌ Blocked	❌ Blocked
Host networking	✅ Allowed	❌ Blocked	❌ Blocked
Host PID/IPC	✅ Allowed	❌ Blocked	❌ Blocked
Run as root	✅ Allowed	✅ Allowed	❌ Blocked
Privilege escalation	✅ Allowed	✅ Allowed	❌ Blocked
Non-root user	Not required	Not required	Required
Read-only root FS	Not required	Not required	Not required

---

Apply PSS via Namespace Labels

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

• enforce — Reject non-compliant pods
• warn — Allow but show warning
• audit — Allow but log violation

---

Example: Restricted Pod

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: my-app:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]

---

Common Mistakes

Mistake	Impact
No pod security standards	Containers can run as root, mount host
Enforcing restricted without testing	Breaks existing workloads
Forgetting system namespaces	kube-system needs privileged

---

What’s Next?

Manage secrets properly: Secrets Management.