Use Pod Security Admission (PSA) to enforce Kubernetes’ standard Pod Security Standards, then add ValidatingAdmissionPolicy (VAP) for custom checks that fit CEL or an external policy engine such as Kyverno when policies need broader workflows or access to other data. These layers all gate API requests before storage, but they run in different places and have different dependencies. Roll them out with audit and warning feedback first, verify support on your cluster version, and plan how exceptions and the policy mechanisms themselves will be governed.
What is Kubernetes admission control?
Admission control evaluates an API request after authentication and authorization but before the requested object is stored. It can accept or reject the request, and some admission mechanisms can also modify objects. This makes admission a useful cluster-side enforcement point: a manifest that passed local review can still be checked when it is submitted to the API server. Kubernetes distinguishes built-in admission from dynamic admission, where the API server sends webhook requests to separately running applications. Kubernetes’ admission-controller documentation and its policy overview describe these mechanisms.
As an Amazon Associate I earn from qualifying purchases.
What do Pod Security Standards and Pod Security Admission cover?
Pod Security Standards (PSS) define three profiles: Privileged, Baseline, and Restricted. Pod Security Admission is Kubernetes’ built-in controller for applying those standards. Namespace labels let administrators choose a profile independently for enforcement, audit, and warnings; the controller also supports version pinning and exemptions. The standards and the controller are therefore a practical starting point when the goal is to apply Kubernetes’ established pod-security rules rather than invent a custom policy language. Kubernetes’ PSA configuration guide documents the labels, configuration, version pinning, and exemptions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11PSA became generally available in Kubernetes v1.25. For the API-server configuration file, Kubernetes documents pod-security.admission.config.k8s.io/v1 for v1.25 and later, v1beta1 for v1.23 and v1.24, and v1alpha1 for v1.22; the file is supplied to kube-apiserver with --admission-control-config-file. These are version-specific configuration facts, not a substitute for checking the documentation and actual API support for the cluster being managed. See the Kubernetes configuration reference.
#1 Best Overall
When should you add CEL-based ValidatingAdmissionPolicy?
Use VAP when a validation rule is custom but can be expressed declaratively with CEL and does not need an external service call. CEL evaluation happens inside the API server, avoiding the separate HTTP webhook dependency of a dynamic admission controller. A policy binding can select the response to a violation: block the request, report it through audit, or return a warning, subject to the policy’s validation actions and cluster support. Kubernetes’ policy overview explains the in-process CEL model and its admission-controller documentation covers the broader admission framework.
Kubernetes’ tutorial lists Kubernetes 1.30 or later for ValidatingAdmissionPolicy. Its tutorial lists Kubernetes 1.36 or later for MutatingAdmissionPolicy, a separate option when a declarative policy needs to mutate requests. Confirm the API and feature availability on the target cluster before designing around either version threshold; version requirements and feature states can change. Kubernetes’ admission-policy tutorial provides its version requirements and examples.
When is an external policy engine such as Kyverno a better fit?
A dynamic policy engine is worth considering when CEL is not a good fit for the rule or the workflow needs richer policy handling. Kubernetes describes webhooks as suitable for checks that retrieve other cluster resources or external data—for example, looking up image signatures or attestations. That flexibility comes with an external component in the request path, so its availability and operation become part of admission reliability. Kubernetes’ policy overview explains this distinction.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsKyverno documents support for all PSS controls and provides a policy collection for installing them. In cluster mode it receives validating and mutating webhook calls from the API server. Its CLI can apply policies to YAML manifests in a delivery pipeline, giving teams a way to find violations before manifests are applied to a cluster. A useful division of labor is to use that earlier feedback while authoring and keep admission enforcement as the cluster-side gate. Kyverno’s PSS guide describes its PSS coverage; its applying-policies guide documents cluster and CLI workflows.
Rank #3
How do the three approaches differ?
| Approach | Where it evaluates | Best-aligned use | Key dependency or consideration |
|---|---|---|---|
| Pod Security Admission | Built into Kubernetes admission | Applying the Privileged, Baseline, and Restricted PSS profiles by namespace | Use audit, warn, enforce, version pinning, and exemptions deliberately; PSA was generally available from Kubernetes v1.25. Kubernetes PSA guide |
| ValidatingAdmissionPolicy | In the API server using CEL | Custom declarative validation that fits CEL | No external webhook callout for evaluation; check the cluster’s API/version support and binding validation actions. Kubernetes policy overview |
| Kyverno | As a dynamic admission controller receiving webhook calls; its CLI can also evaluate manifests in a pipeline | PSS policy support and policy workflows that benefit from a policy engine and pre-deployment manifest checks | The cluster-side webhook component is an operational dependency; its CLI workflow can complement, rather than replace, admission enforcement. Kyverno applying-policies guide |
This is a decision aid, not an exhaustive comparison of Kyverno with OPA Gatekeeper or every policy engine. Kubernetes identifies both Kyverno and OPA Gatekeeper among ecosystem options, but a meaningful selection requires evaluating the particular versions, workloads, and operating model in use. Compare evaluation location and dependencies, language and authoring workflow, data access, mutation or generation needs, pre-apply testing, exception handling, and policy bootstrap and protection. Kubernetes’ policy overview and Kyverno’s workflow documentation support the distinctions described here.
How do you move from PSS to policy-as-code gates?
- Inventory the workloads and current exceptions. Identify namespaces and workloads affected by the PSS profiles you plan to use, and determine which need changes or explicit exemptions before enforcement becomes stricter.
- Start with feedback, not a surprise block. Configure the intended profile in audit and warning modes so teams can identify noncompliant workloads. Kubernetes recommends this staged approach to surface violations before moving to enforcement. Kubernetes’ enforcement guidance explains the rollout approach.
- Remediate, document exceptions, and pin the intended version. Address violations where possible, record justified exceptions, and choose a PSS version explicitly when predictable behavior across Kubernetes upgrades matters. PSA supports exemptions and version selection. The PSA guide documents those controls.
- Enable enforcement in a controlled scope. Move suitable namespaces to the chosen enforce profile after reviewing the audit and warning results; avoid applying a stricter profile cluster-wide until its impact is understood.
- Add custom policy only for requirements PSS does not express. Prefer VAP for custom declarative checks that fit CEL and do not need external data. Choose a webhook-based engine when the rule or workflow requires capabilities such as retrieving other resources or external information.
- Test policy changes before rollout and at admission. Use the selected engine’s available manifest-checking workflow in CI or another delivery stage, then rely on cluster admission for the enforcement decision. For Kyverno, the documented CLI can apply policies to YAML manifests before cluster deployment. Kyverno’s guide describes this workflow.
How should the policy control plane itself be protected?
Admission policy is security-critical configuration, so consider how policy definitions are bootstrapped and whether the system can protect its own controls. Kubernetes v1.37 documents manifest-based admission control as Beta and enabled by default in that version. It loads webhook and CEL admission-policy resources from static files at API-server startup. Kubernetes describes this as addressing the bootstrap gap before API-registered policies load, the self-protection gap created because API-registered admission configuration is not itself subject to webhook admission, and reliance on etcd. The file-based mechanism can protect admission resources independently of etcd, but its documented constraints include not referencing ConfigMaps or other cluster objects for policy parameters. Check support and restrictions for the specific cluster version before relying on it. Kubernetes’ manifest-based admission control documentation describes its status and limitations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
