adaptive-enforcement-lab/kyverno-pod-security-templates

Kyverno Pod Security Templates

When to Use This Skill

Pod security policies prevent privilege escalation, restrict dangerous capabilities, and enforce security boundaries for containerized workloads.

Pod Security Standards Replace PSP

PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in 1.25. Use Pod Security Standards (PSS) via admission controllers or Kyverno policies instead.

When to Apply

Scenario 1: Block All Privileged Containers

Prevent privileged mode across the cluster:

# Enforced by: privileges.yaml
# Result: No containers can run with privileged: true
# Impact: Eliminates most container breakout vectors

Scenario 2: Require Non-Root Execution

Force all containers to run as non-root users:

# Enforced by: profiles.yaml
# Result: Containers must define runAsNonRoot: true
# Impact: Prevents root-level filesystem access and privilege escalation

Scenario 3: Enforce Seccomp Profiles

Mandate seccomp profiles for syscall filtering:

# Enforced by: standards.yaml
# Result: Pods must define securityContext.seccompProfile
# Impact: Reduces kernel attack surface by blocking dangerous syscalls

Implementation

See the full implementation guide in the source documentation.

Examples

See examples.md for code examples.

Full Reference

See reference.md for complete documentation.

Related Patterns

• Kyverno Templates Overview
• Kyverno Network Security
• OPA Pod Security Templates

References

• Source Documentation
• AEL Enforce