Lesson 0031 · 25 minutes · Cluster Hardening

Reject privileged containers with native admission control

Write a policy and binding from memory, then prove both enforcement and namespace scope. This is a focused retrieval drill: no webhook and no third-party policy engine.

Timed task: 15 minutes

Apply lab/lesson-31-fixture.yaml. Create lab/lesson-31-answer.yaml from scratch with exactly two resources:

one ValidatingAdmissionPolicy; and
one ValidatingAdmissionPolicyBinding.

The policy must evaluate Pod CREATE and UPDATE requests. It must reject a Pod when any regular container or init container explicitly sets securityContext.privileged: true.

The binding must enforce the policy with Deny only in namespaces labelled cks-training=admission. Use a helpful validation message. Do not reject containers that omit securityContext or omit privileged.

Retrieval target: optional fields are the trap. Your CEL must safely handle a missing securityContext and a missing privileged field. Remember that the policy defines logic and request matching; the binding supplies enforcement action and namespace scope.

Verification

kubectl apply -f .\lab\lesson-31-fixture.yaml
kubectl apply -f .\lab\lesson-31-answer.yaml

kubectl -n admission-lab run allowed --image=nginx:1.27-alpine --restart=Never
kubectl -n admission-lab run denied --image=nginx:1.27-alpine --restart=Never --overrides='{"spec":{"containers":[{"name":"denied","image":"nginx:1.27-alpine","securityContext":{"privileged":true}}]}}'
kubectl -n admission-control run outside-scope --image=nginx:1.27-alpine --restart=Never --overrides='{"spec":{"containers":[{"name":"outside-scope","image":"nginx:1.27-alpine","securityContext":{"privileged":true}}]}}'

Expected: allowed is admitted, denied is rejected with your message, and outside-scope is admitted.

Retrieval check

Question

Where should the namespace selector and Deny action be configured?

In the policy binding, which scopes and enforces the policy. In the policy validation, which replaces the binding entirely. In Namespace annotations, which execute the CEL expression directly.

Documentation target

Use the official Validating Admission Policy documentation only after your first attempt. Inspect local schemas with kubectl explain validatingadmissionpolicy.spec and kubectl explain validatingadmissionpolicybinding.spec.

What to send me

Save the answer, run the three checks, then say check. I will review only the first issue at a time. Ask me a follow-up question whenever a field or CEL expression is unclear.