Implementing Pod Security Admission Controller

Overview

Pod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.

When to Use

• Wiring PSA up on a cluster for the first time
• Setting cluster-wide default enforcement via AdmissionConfiguration
• Exempting system namespaces, service accounts, or runtime classes from enforcement
• Debugging why a pod was rejected, or why enforcement is silently not firing
• Staging a safe rollout: warn and audit first, enforce once violations reach zero
• Pulling PSA violations out of the kube-apiserver audit log

Not this skill: deciding which profile a workload should run under, or what securityContext changes Restricted demands. Use implementing-kubernetes-pod-security-standards.