~/ nmadiraju.com Amazon EKS · Pod Security Admission
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Pod Security Admission Works on Amazon EKS

Follow namespace shop from a privileged debug Pod to every Pod passing restricted, then check yourself with 8 questions.

1Visual Walkthrough

Pod Security admission in the EKS API server checking Pods in namespace shop against its labels Left, you with kubectl and a counter of shop's Pods that fail restricted. The EKS control plane holds the built-in Pod Security admission, the three Pod Security Standards levels (privileged, baseline, restricted), the admission config set by EKS, and the ReplicaSet controller. Right, namespace shop with its labels, Deployment web, its ReplicaSet, a debug Pod and web's Pods. The walkthrough shows a privileged Pod admitted by default, enforce=baseline rejecting a second one, the running one only warned about and then deleted, a Deployment whose Pods restricted rejects, warn and audit, a hardened Pod template, and restricted enforced with a pinned version. You · kubectl shop's team EKS CONTROL PLANE · KUBERNETES API SERVER Pod Security admission (built in) checks each Pod against its namespace's labels POD SECURITY STANDARDS · 3 FIXED LEVELS privileged no checks: anything is allowed (what EKS applies by default) baseline blocks privileged, hostPath, hostPort, host namespaces, extra capabilities restricted baseline + non-root user, no escalation, drop all capabilities, default seccomp Admission config defaults: privileged exemptions: none set by EKS · you can't edit it ReplicaSet controller creates Pods from a ReplicaSet's template NAMESPACE shop Namespace shop · labels Deployment web replicas 3 ReplicaSet (newest) desired 3 Pod debug privileged · hostPath / web Pods app=web

    2Quiz to check understanding

    Check yourself