What is a PodSecurityPolicy?
A PSP is a Kubernetes resource that allows you to set security controls for your workloads, allowing you to set limitations on what a pod can do. PSPs are evaluated before a pod is allowed to start up and if the pod attempts to do something that a PSP forbids, it will not be allowed to start.
Many people have experience with physical and virtual servers, and most know how to secure workloads running on them. Containers need to be considered differently when you talk about securing each workload. To understand why PSPs and other Kubernetes security tools such as the Open Policy Agent (OPA) exist, you need to understand how a container is different from a virtual machine (VM).
Understanding the difference between containers and VMs
"A container is a lightweight VM" is often how containers are described to those new to containers and Kubernetes. While this makes for a simple analogy, from a security standpoint, it's a dangerous comparison...
