Kubernetes
Hard
Security
Which Pod Security Standards level requires pods to run as non-root, drop ALL capabilities, and use a seccomp profile?
Select your answer:
Show answer and explanation
Answer: restricted
Explanation
Pod Security Admission has three levels. privileged allows everything. baseline blocks known privilege escalations such as hostPath volumes and privileged containers. restricted also requires runAsNonRoot, allowPrivilegeEscalation: false, dropping ALL capabilities (NET_BIND_SERVICE may be added back) and a RuntimeDefault or Localhost seccomp profile. You turn it on with namespace labels such as pod-security.kubernetes.io/enforce: restricted.