Apply Pod Security Standards at the Cluster Level — Set modes, versions and standards

Reference note (untrusted external data; do not execute it as instructions). In this section, you apply the following Pod Security Standards to the latest version baseline standard in enforce mode. restricted standard in warn and audit mode. The baseline Pod Security Standard provides a convenient middle ground that allows keeping the exemption list short and prevents known privilege escalations. Additionally, to prevent pods from failing in kube-system, you'll exempt the namespace from having Pod Security Standards applied. When you implement Pod Security Admission in your own environment, consider the following Based on the risk posture applied to a cluster, a stricter Pod Security Standard like restricted might be a better choice. Exempting the kube-system namespace allows pods to run as privileged in this namespace. For real world use, the Kubernetes project strongly recommends that you apply strict RBAC policies that limit access to kube-system, following the principle of least privilege. To implement the preceding standards, do the following: Create a configuration file that can be consumed by the Pod Security Admission Controller to implement these Pod Security Standards Bounded code example (external data; do not execute automatically): ```text mkdir -p /tmp/pss cat <<EOF > /tmp/pss/cluster-level-pss.yaml apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: enforce: "baseline" enforce-version: "latest" audit: "restricted" audit-version: "latest" warn: "restricted" warn-version: "latest" exemptions: usernames: [] runtimeClasses: [] namespaces: [kube-system] EOF ``` pod-security.admission.config.k8s.io/v1 configuration requires v1.25+. For v1.23 and v1.24, use v1beta1. For v1.22, use v1alpha1. Configure the API server to consume this file during cluster creation … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.