mirror of
https://github.com/ghndrx/k8s-manifests.git
synced 2026-02-10 06:45:09 +00:00
58e8140f36
- Add namespace templates for privileged, baseline, and restricted levels - Include compliant deployment examples for baseline and restricted - Add migration audit script for checking namespace compliance - Document PSA levels, enforcement modes, and migration strategy Follows Kubernetes Pod Security Admission best practices for 2025+. Reference: https://kubernetes.io/docs/concepts/security/pod-security-standards/
26 lines
905 B
YAML
26 lines
905 B
YAML
# Privileged namespace - for system-level workloads only
|
|
# Use sparingly: CNI plugins, monitoring agents, storage drivers
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: privileged-system
|
|
labels:
|
|
# PSA labels - privileged level
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
# Metadata
|
|
environment: system
|
|
security-level: privileged
|
|
annotations:
|
|
description: "Privileged namespace for system workloads requiring host access"
|
|
---
|
|
# Example: kube-system should typically be privileged
|
|
# To label an existing namespace:
|
|
# kubectl label namespace kube-system \
|
|
# pod-security.kubernetes.io/enforce=privileged \
|
|
# pod-security.kubernetes.io/audit=privileged \
|
|
# pod-security.kubernetes.io/warn=privileged \
|
|
# --overwrite
|