Pod Security Standards

Since Pod Security Policies have been removed in Kubernetes v1.25, Kubernetes offers Pod Security Standards – a new way to enhance cluster security.

To enable PSS in k0s you need to create an admission controller config file:

  1. ```yaml
  2. apiVersion: apiserver.config.k8s.io/v1
  3. kind: AdmissionConfiguration
  4. plugins:
  5. - name: PodSecurity
  6.   configuration:
  7.     apiVersion: pod-security.admission.config.k8s.io/v1beta1
  8.     kind: PodSecurityConfiguration
  9.     # Defaults applied when a mode label is not set.
  10.     defaults:
  11.       enforce: "privileged"
  12.       enforce-version: "latest"
  13.     exemptions:
  14.       # Don't forget to exempt namespaces or users that are responsible for deploying
  15.       # cluster components, because they need to run privileged containers
  16.       usernames: ["admin"]
  17.       namespaces: ["kube-system"]
  18. ```

Add these extra arguments to the k0s configuration:

  1. ```yaml
  2. apiVersion: k0s.k0sproject.io/v1beta1
  3. kind: ClusterConfig
  4. spec:
  5.   api:
  6.     extraArgs:
  7.       admission-control-config-file: /path/to/admission/control/config.yaml
  8. ```