World K6: Guards

Pod Security Standards

You will learn: the three Pod Security levels, and how one label switches a zone's guard on.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

You are here: cluster kind-dev namespace default

~/shop $ kubectl apply -f plain.yamlError from server (Forbidden): error when creating "plain.yaml": pods "plain" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "web" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "web" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "web" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "web" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

A plain nginx tray. It ran fine yesterday. Today the kedai zone refuses it, with four reasons. Plain words: this zone only takes locked-up trays.

Watch

Tap each point on the timeline.

The are three hygiene levels for trays. Tap each one, loosest first.

Watch

You are here: cluster kind-dev namespace default

~/shop $ cat zone.yamlapiVersion: v1kind: Namespacemetadata:  name: kedai  labels:    pod-security.kubernetes.io/enforce: restricted

One label on the zone switches the guard on. enforce refuses bad pods. warn lets them in, with a warning.

Try it

Which level is the first to refuse each tray?

Drag a card into a box. Or tap the card, then tap the box.

Try it

Switch the guard on for the kedai zone, at the restricted level.

You are here: cluster kind-dev namespace default

dev-control-planeOpenManager

No trays here.

dev-workerOpen

No trays here.

dev-worker2Open

No trays here.

Time: +0s (sped up)

Hint

The label key is pod-security.kubernetes.io/enforce.

Predict

Three old root pods already run in kedai. You switch on restricted. What happens to them?

Check

Good habit, or risky? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Turn on warn=restricted first, then fix what it reports

You did it!

You can now switch on a Pod Security level for a zone.

Go deeper (optional)

There are three modes: enforce, warn and audit (writes to the audit log). Pin a version with pod-security.kubernetes.io/enforce-version: v1.37. For a Deployment, the guard only warns. Its ReplicaSet’s pods are refused later. You meet that in the boss.

Real mission

On a throwaway cluster, make a zone.
kubectl create namespace guard-test
Dry run first.
kubectl label --dry-run=server --overwrite ns guard-test pod-security.kubernetes.io/enforce=restricted
Now for real.
kubectl label ns guard-test pod-security.kubernetes.io/enforce=restricted
Try a plain pod. Read the four reasons.
kubectl run plain -n guard-test --image=nginx:1.29-alpine

0 of 4 steps done · Your ticks are saved.