Pod Security Standards
also: PSS, Pod Security Admission
Pod Security Standards (PSS) are Kubernetes policies that enforce security best practices by restricting what capabilities, privileges, and system access a pod can have. They replace the deprecated Pod Security Policies with a simpler, built-in admission control mechanism.
Pod Security Standards define three security levels—Restricted, Baseline, and Unrestricted—that govern pod behavior in a Kubernetes cluster. Each level applies to a namespace and prevents pods from violating security constraints before they run.
The Restricted level enforces hardened defaults: no root containers, no privileged mode, read-only filesystems, and dropped Linux capabilities. The Baseline level allows common patterns while blocking known privilege escalations. Unrestricted applies no constraints.
Example: To enforce baseline security on a namespace, add a label: pod-security.kubernetes.io/enforce: baseline. Pods violating this standard will be rejected at admission time. This prevents misconfigured or intentionally malicious workloads from accessing sensitive host resources.