Using Pod Security Standards to enforce Node Security

The Pod Security Standards are the “replacement” for Pod Security Policies. I put the term “replacement” in quotes because the PSA isn’t a feature comparable replacement to PSPs, but it aligns with a new strategy defined in the Pod Security Standards guide (https://kubernetes.io/docs/concepts/security/pod-security-standards/). The basic principle of PSA is that since the namespace is the security boundary in Kubernetes, that is where it should be determined whether pods should run in a privileged or restricted mode.

At first glance, this makes a great deal of sense. When we talked about multitenancy and RBAC, everything was defined at the namespace level. Much of the difficulties of PSPs came from trying to determine how to authorize a policy, so this eliminates that problem.

The concern though is that there are scenarios where you need a privileged container, but you don’t want...