Wiz Guide Details Migrating Kubernetes from Pod Security Policies to Pod Security Standards

Article Details

Defense Focus

Safely migrate Kubernetes workloads from Pod Security Policies to Pod Security Admission and Pod Security Standards, then monitor policy coverage and permissions that could weaken namespace controls.

Detection Methods

• Use server-side dry runs when applying namespace security labels to identify existing workloads that violate the selected Pod Security level.
• Apply audit or warn modes before enforcement and review the resulting policy-violation warnings for newly created pods.
• Use Wiz's built-in Cloud Configuration Rule to identify workloads running without an assigned Pod Security Policy at the cluster level.
• Assess clusters and namespaces with the built-in Pod Security Standards frameworks to identify suitable policy levels.
• Use a query to identify Kubernetes principals that can modify namespace Pod Security levels.
• Use runtime checks at container startup to catch images configured to run as root despite pod-level security settings.

Data Sources

• Kubernetes cluster, namespace, pod, and workload configuration
• Pod Security Admission audit, warn, and enforcement results
• Kubernetes API server request telemetry, including requests shown with kubectl --v=8
• Kubernetes API scan objects
• Kubernetes user and service-account permissions to patch or update namespaces
• Container runtime startup checks

Rule Types

• Wiz Cloud Configuration Rule for workloads without an assigned Pod Security Policy
• Pod Security Standards assessment frameworks
• Wiz Admission Controller rules for requiring an assigned namespace security level and disallowing the privileged level

Platforms

• Kubernetes
• AKS
• EKS
• GKE

Defensive Actions

• Begin migration before upgrading to Kubernetes 1.25, when Pod Security Policies are removed.
• Test policy levels with server-side dry runs before applying changes.
• For existing workloads, use audit or warn modes first, review violations, remediate workloads, and then enforce the selected level.
• Where supported on Kubernetes 1.24 and below, keep Pod Security Policies active until Pod Security Admission is enforcing.
• Separate workloads that require special privileges into different namespaces where practical; use exemptions selectively, and prefer the privileged level over leaving a namespace without a policy.
• Allow only explicitly labelled namespaces and review which users and service accounts can patch or update namespace security labels.
• Use Wiz Admission Controller rules to require an assigned namespace security level and to prevent assignment of the privileged level where appropriate.
• Identify and remove completed or otherwise stale pods that block policy application.