Kubernetes: Check Pod Security Admission Status

Nov 8, 2025 by Admin 48 views

Kubernetes: Checking if Pod Security Admission is Enabled

Let's dive into how you can verify whether Pod Security Admission (PSA) is enabled in your Kubernetes cluster. For those new to the concept, PSA is a built-in Kubernetes admission controller that enforces Pod Security Standards. These standards define different levels of security for your pods, helping you ensure that your applications are running in a secure and controlled environment. Knowing whether PSA is active and how it's configured is crucial for maintaining the security posture of your cluster. So, let’s get started, shall we?

Understanding Pod Security Admission

Before we get into the nitty-gritty of checking if PSA is enabled, let's quickly recap what it is and why it matters. Pod Security Admission automatically enforces the Pod Security Standards (PSS) at the namespace level. These standards are predefined security profiles that range from highly permissive to highly restrictive.

Privileged: This is the most permissive level, essentially unrestricted. It's generally meant for system-level pods and should be avoided for general application workloads.
Baseline: This level provides a reasonable balance between security and usability. It prevents known privilege escalations and allows most common pod configurations.
Restricted: This is the most restrictive level, enforcing strong security policies to protect against a wide range of potential vulnerabilities.

PSA operates by intercepting pod creation and update requests. It evaluates the pod's configuration against the configured security standards for the namespace. If a pod violates the policy, PSA can either warn, audit, or prevent the pod from being created.

Enabling and configuring PSA correctly is vital for several reasons:

Enhanced Security: It helps prevent misconfigurations and vulnerabilities that could be exploited by attackers.
Compliance: It assists in meeting compliance requirements by enforcing security best practices.
Simplified Management: It provides a centralized way to manage pod security policies across your cluster.

Alright, now that we have a solid understanding of what PSA is, let's move on to the main question: How do we check if it's enabled?

Methods to Check if Pod Security Admission is Enabled

There are several ways to determine whether Pod Security Admission is enabled in your Kubernetes cluster. We'll explore a few common methods, starting with the most straightforward one.

1. Using `kubectl` to Inspect Namespace Annotations

The most direct way to check if PSA is enabled is by inspecting the annotations on your namespaces. PSA uses annotations to define the enforcement level for each of the Pod Security Standards.

Here’s how you can do it:

List Namespaces: First, list all the namespaces in your cluster to identify the ones you want to inspect. You can use the following command:
```
kubectl get namespaces
```
Describe a Namespace: Once you've identified the namespace you're interested in, use the kubectl describe namespace command to view its details. Replace <namespace-name> with the actual name of the namespace.
```
kubectl describe namespace <namespace-name>
```
Examine Annotations: Look for the following annotations in the output:
- pod-security.kubernetes.io/enforce: This annotation defines the policy that will prevent pods from being created if they violate the specified standard.
- pod-security.kubernetes.io/audit: This annotation defines the policy that will add an audit annotation to events when a pod violates the specified standard.
- pod-security.kubernetes.io/warn: This annotation defines the policy that will generate a user-facing warning when a pod violates the specified standard.
Each of these annotations should have a value corresponding to one of the Pod Security Standard levels: privileged, baseline, or restricted. For example:
```
annotations:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: privileged
```
If you see these annotations with any of the PSS levels, it means that Pod Security Admission is enabled for that namespace. If the annotations are missing, PSA is either not enabled or is relying on the default configuration.

2. Checking API Server Configuration

Another way to verify if PSA is enabled is by checking the API server configuration. PSA is implemented as an admission controller, so it needs to be enabled in the API server's configuration.

Access the API Server Configuration: The method for accessing the API server configuration varies depending on how your Kubernetes cluster is set up. In some cases, you might need to SSH into the control plane nodes and inspect the configuration files directly. In other cases, you might be able to retrieve the configuration through your cloud provider's management console.
Inspect the --enable-admission-plugins Flag: Look for the --enable-admission-plugins flag in the API server's command-line arguments. This flag specifies the list of admission controllers that are enabled. Make sure that PodSecurity is included in the list.

For example:
```
--enable-admission-plugins=...,PodSecurity,...
```
If PodSecurity is present, it means that the PSA admission controller is enabled at the cluster level. However, this doesn't necessarily mean that it's actively enforcing policies in all namespaces. You'll still need to check the namespace annotations to determine the specific enforcement levels.

3. Using the `--dry-run` Flag to Test Pod Creation

A more practical approach is to use the --dry-run flag with kubectl to simulate the creation of a pod that violates a specific Pod Security Standard. This allows you to see how PSA would react without actually creating the pod.

Here’s how you can do it:

Create a Pod Manifest: Create a YAML file (e.g., test-pod.yaml) that defines a pod that violates a specific PSS level. For example, to violate the restricted level, you can create a pod that requests host networking.
```
apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  hostNetwork: true
  containers:
  - name: test-container
    image: nginx
```
Apply the Manifest with --dry-run=server: Use the kubectl apply command with the --dry-run=server flag to simulate the pod creation. This will send the request to the API server, which will then evaluate it against the configured admission controllers, including PSA.
```
kubectl apply -f test-pod.yaml --dry-run=server
```
Analyze the Output: If PSA is enabled and enforcing the restricted level, you should see an error message indicating that the pod violates the policy. The error message will typically include details about the specific violation and the policy that was violated.

For example:
```
Error from server (Forbidden): error when creating "test-pod.yaml": pods "test-pod" is forbidden: violates PodSecurityPolicy: restricted.hostNetwork: hostNetwork is not allowed to be set to true
```
If you don't see an error message, it could mean that PSA is not enabled, or that the namespace is configured with a more permissive level (e.g., privileged or baseline).

Practical Examples and Scenarios

To further illustrate how to check if PSA is enabled, let's consider a few practical examples and scenarios.

Scenario 1: Checking a Namespace with Enforce Policy

Suppose you have a namespace named production and you want to check if PSA is enforcing the restricted policy. You can use the following command:

kubectl describe namespace production | grep pod-security.kubernetes.io/enforce

If the output shows:

pod-security.kubernetes.io/enforce: restricted

It means that PSA is enabled and enforcing the restricted policy for that namespace. Any pod that violates the restricted standard will be prevented from being created.

Scenario 2: Checking a Namespace with Audit and Warn Policies

Now, let's say you have a namespace named development and you want to check the audit and warn policies. You can use the following commands:

kubectl describe namespace development | grep pod-security.kubernetes.io/audit
kubectl describe namespace development | grep pod-security.kubernetes.io/warn

If the outputs show:

pod-security.kubernetes.io/audit: baseline
pod-security.kubernetes.io/warn: privileged

It means that PSA is configured to add audit annotations for pods that violate the baseline standard and generate warnings for pods that violate the privileged standard. This can be useful for monitoring and identifying potential security issues without immediately preventing pod creation.

Scenario 3: Testing Pod Creation with `--dry-run`

Let's walk through a complete example of using the --dry-run flag to test pod creation. Assume you have a namespace named test and you want to verify if PSA is enabled.

Create a Namespace: If the test namespace doesn't exist, create it using the following command:
```
kubectl create namespace test
```

Annotate the Namespace: Set the enforce policy to restricted for the test namespace:

kubectl annotate namespace test pod-security.kubernetes.io/enforce=restricted

Create a Pod Manifest: Create a YAML file named test-pod.yaml with the following content:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  hostNetwork: true
  containers:
  - name: test-container
    image: nginx

Apply the Manifest with --dry-run=server: Run the following command:
```
kubectl apply -f test-pod.yaml --dry-run=server -n test
```
Analyze the Output: If PSA is enabled and enforcing the restricted policy, you should see an error message similar to this:
```
Error from server (Forbidden): error when creating "test-pod.yaml": pods "test-pod" is forbidden: violates PodSecurityPolicy: restricted.hostNetwork: hostNetwork is not allowed to be set to true
```
This confirms that PSA is enabled and actively enforcing the restricted policy in the test namespace.

Troubleshooting Common Issues

While checking if PSA is enabled is generally straightforward, you might encounter some common issues. Let's address a few of them.

Issue 1: Missing Annotations

If you don't see the pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/audit, or pod-security.kubernetes.io/warn annotations on your namespaces, it could mean that PSA is not enabled or that the namespace is relying on the default configuration. To resolve this, you can manually add the annotations using the kubectl annotate command.

Issue 2: Unexpected Errors

If you encounter unexpected errors when creating pods, make sure that the pod's configuration complies with the configured Pod Security Standards. Use the kubectl describe pod command to get more details about the error and identify the specific violation.

Issue 3: API Server Configuration Issues

If you suspect that PSA is not enabled in the API server configuration, check the --enable-admission-plugins flag and ensure that PodSecurity is included in the list. If it's missing, you'll need to update the API server configuration and restart the API server.

Issue 4: Conflicting Admission Controllers

In some cases, you might have other admission controllers that conflict with PSA. Make sure that there are no conflicting policies or configurations that could interfere with PSA's operation. Review the configuration of all enabled admission controllers and resolve any conflicts.

Best Practices for Managing Pod Security Admission

To effectively manage Pod Security Admission in your Kubernetes cluster, consider the following best practices:

Start with a Permissive Policy: When initially enabling PSA, start with a more permissive policy (e.g., baseline) and gradually move to a more restrictive policy (e.g., restricted) as you gain more confidence in your application's security posture.
Use Audit and Warn Modes: Use the audit and warn modes to monitor and identify potential security issues before enforcing strict policies. This allows you to proactively address any violations without disrupting your applications.
Automate Policy Enforcement: Use tools like GitOps to automate the enforcement of PSA policies. This ensures that your policies are consistently applied across all namespaces and environments.
Regularly Review and Update Policies: Regularly review and update your PSA policies to keep up with the latest security threats and best practices. This helps ensure that your cluster remains secure and compliant.
Provide Training and Documentation: Provide training and documentation to your development teams on how to create and deploy pods that comply with the configured Pod Security Standards. This helps prevent accidental violations and promotes a security-conscious culture.

Conclusion

Alright, folks! We've covered quite a bit in this guide. You now know how to check if Pod Security Admission is enabled in your Kubernetes cluster using various methods, including inspecting namespace annotations, checking API server configuration, and using the --dry-run flag. Remember, keeping your cluster secure is an ongoing process, and understanding tools like PSA is a big step in the right direction. Keep experimenting, stay curious, and happy securing!