Lesson 0021 · 40 minutes · Minimize Microservice Vulnerabilities

Introduce restricted policy without losing visibility

Pod Security Admission has three independent modes: enforce blocks a workload, audit records violations, and warn informs the requesting user. Mature rollouts often use all three during a migration.

Exam reflex: these are Namespace labels. Each mode needs its own label key and can use a different target level or version. Enforcement alone is not the whole rollout story.

Timed task: 30 minutes

Apply lab/lesson-21-fixture.yaml. Create lab/lesson-21-answer.yaml from scratch. Do not change the fixture.

Deliver a safe migration for namespace partner-workloads:

Existing Pods must remain running.
New or updated Pods must be rejected unless they meet the restricted Pod Security Standard.
Violations must also be visible through audit and user-facing warnings at restricted.
Pin every mode to the Kubernetes minor version running in this cluster.
Create a compliant replacement Pod named exporter-v2 in the same namespace, using image busybox:1.37, command sh -c 'sleep 3600', and label app=exporter.

The replacement must run as non-root UID 1000, use RuntimeDefault seccomp, prevent privilege escalation, and drop all capabilities. Do not mount a ServiceAccount token. No starter Pod or namespace-label YAML is provided.

Verification

kubectl --context kind-cks-lab version --output=yaml
kubectl --context kind-cks-lab apply -f .\lab\lesson-21-fixture.yaml
kubectl --context kind-cks-lab apply -f .\lab\lesson-21-answer.yaml
kubectl --context kind-cks-lab -n partner-workloads get pod legacy-exporter exporter-v2
kubectl --context kind-cks-lab -n partner-workloads run rejected-test --image=busybox:1.37 --restart=Never -- sh -c 'sleep 60'
kubectl --context kind-cks-lab get namespace partner-workloads --show-labels

Expected: legacy-exporter remains running, exporter-v2 is Ready, and rejected-test is denied. The final command must show six PSA labels: enforce, audit, and warn levels plus their three version labels.

Retrieval check

Question

Which Pod Security Admission mode blocks a non-compliant new Pod?

Enforce.Audit.Warn.

Documentation target

Use the official Kubernetes Pod Security Admission reference. Confirm the exact label names and version formatting instead of relying on memory.

What to send me

Paste your namespace and replacement-Pod YAML, plus the rejected admission message. I’ll check all three modes, version pinning, and workload compliance.