Pod Security Standards enforcement at namespace level

Pod Security Standards (PSS) provide namespace-level policy enforcement that is evaluated before pod admission — without them, a misconfigured or malicious workload can deploy privileged containers, run as root, or mount host paths regardless of what individual securityContext fields are set (NIST 800-53 AC-3, CIS Kubernetes 5.2.1/5.2.6). PSS restricted blocks the entire class of misconfigurations — running as root, privilege escalation, host namespaces — at the namespace boundary. Individual securityContext checks on Deployments are necessary but not sufficient; without PSS, nothing prevents a developer from removing those fields.

Label every application namespace with PSS enforcement labels. Apply via kubectl:

kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

For namespaces running legacy workloads that cannot yet meet restricted, use baseline enforcement as an intermediate step:

kubectl label namespace legacy-ns \
  pod-security.kubernetes.io/enforce=baseline

Run kubectl label namespace --dry-run=server ... first to see which existing pods would be rejected before enforcement goes live. PSS is built into Kubernetes 1.25+ — no additional admission controller installation required.