~/ nmadiraju.com Amazon EKS · Pod Security Admission
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Pod Security Admission Works on Amazon EKS

Follow namespace shop from a privileged debug Pod to Deployment web running under restricted, then check yourself with 8 questions.

1Visual Walkthrough

Pod Security admission in the EKS API server checking Pods in namespace shop against its labels Left, you with kubectl. The EKS control plane holds the built-in Pod Security admission, the three Pod Security Standards levels (privileged, baseline, restricted), the admission config set by EKS, and the ReplicaSet controller. Right, namespace shop with its labels, Deployment web, its ReplicaSet, a debug Pod and web's Pods, and namespace kube-system with aws-node and kube-proxy. The walkthrough shows a privileged Pod admitted by default, enforce=baseline rejecting it, running Pods only warned, a Deployment that can't create Pods, warn and audit, a restricted securityContext, version pinning and EKS's fixed exemptions. You · kubectl shop's team EKS CONTROL PLANE · KUBERNETES API SERVER Pod Security admission (built in) checks each Pod against its namespace's labels POD SECURITY STANDARDS · 3 FIXED LEVELS privileged no checks: anything is allowed (what EKS applies by default) baseline blocks privileged, hostPath, hostPort, host namespaces, non-default caps restricted baseline + runAsNonRoot, drop ALL caps, seccomp RuntimeDefault, no escalation Admission config defaults: privileged exemptions: none set by EKS · you can't edit it ReplicaSet controller creates Pods from a ReplicaSet's template NAMESPACE shop Namespace shop · labels Deployment web replicas 3 ReplicaSet (newest) desired 3 Pod debug privileged · hostPath / web Pods app=web NAMESPACE kube-system · NO POD SECURITY LABELS DaemonSet aws-node hostNetwork · hostPath the VPC CNI on every node DaemonSet kube-proxy hostNetwork · hostPath Service rules on every node

    2Quiz to check understanding

    Check yourself