Kubernetes Admission Control: From PodSecurity Standards to Custom OPA/Kyverno Policies

Problem

Without admission control, any user with deployment permissions can run privileged containers, mount the host filesystem, use the host network, run as root, and bypass every security boundary Kubernetes provides. Pod Security Standards (built-in since v1.25) provide a baseline, but production enforcement needs custom policies that go beyond what PSS covers: blocking the latest tag, requiring resource limits, enforcing specific image registries, mandating team labels, and verifying image signatures.

The landscape is fragmented: Pod Security Standards, OPA Gatekeeper, and Kyverno each solve the problem differently. Teams waste time evaluating tools instead of writing policies.

Target systems: Kubernetes 1.29+. Covers Pod Security Standards (built-in), Kyverno 1.12+, and OPA Gatekeeper 3.16+.

Threat Model

• Adversary: Malicious or negligent developer deploying insecure workloads (privileged container, host path mount, running as root), or supply chain attacker injecting a malicious container image from an unauthorized registry.
• Blast radius: A single privileged container can compromise the entire node and all pods on it. A host path mount can read any file on the node, including kubelet credentials and other pods’ secrets.

Configuration

Pod Security Standards (Built-In Baseline)

PSS is built into Kubernetes, no installation needed. Three profiles: privileged (unrestricted), baseline (prevents known privilege escalations), restricted (best practice for hardened workloads).

# Enforce 'restricted' on all application namespaces:
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

# Use 'baseline' for kube-system (some system components need elevated privileges):
kubectl label namespace kube-system \
  pod-security.kubernetes.io/enforce=baseline \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

What PSS restricted blocks:

• Privileged containers
• Host namespaces (hostNetwork, hostPID, hostIPC)
• Host path mounts
• Running as root
• Privilege escalation
• Non-default seccomp profiles (must use RuntimeDefault or Localhost)
• Capabilities beyond a small allowlist

What PSS does NOT cover (need Kyverno or Gatekeeper):

• Image registry allowlisting
• latest tag blocking
• Resource limit requirements
• Label requirements
• Image signature verification
• Custom organisation-specific policies

Choosing Kyverno vs OPA Gatekeeper

Recommendation: Kyverno for teams that want YAML policies and need generate/mutate capabilities. Gatekeeper for teams with existing Rego expertise or complex cross-resource policies. Both are production-ready.

Kyverno: Essential Policies

Install Kyverno:

helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update

helm install kyverno kyverno/kyverno \
  --namespace kyverno --create-namespace \
  --set replicaCount=3 \
  --set resources.requests.memory=256Mi \
  --set resources.limits.memory=512Mi

Block latest tag:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: validate-image-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Using the 'latest' tag is not allowed. Specify a version tag."
        pattern:
          spec:
            containers:
              - image: "!*:latest & *:*"
            =(initContainers):
              - image: "!*:latest & *:*"

Require resource limits:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: validate-resources
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "CPU and memory limits are required for all containers."
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"

Restrict image registries:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: validate-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: >-
          Images must be from approved registries:
          registry.example.com, ghcr.io/your-org, docker.io/library.
        pattern:
          spec:
            containers:
              - image: "registry.example.com/* | ghcr.io/your-org/* | docker.io/library/*"
            =(initContainers):
              - image: "registry.example.com/* | ghcr.io/your-org/* | docker.io/library/*"

Require team labels:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: require-team-label
      match:
        any:
          - resources:
              kinds:
                - Deployment
                - StatefulSet
                - DaemonSet
      validate:
        message: "The label 'team' is required on all workloads."
        pattern:
          metadata:
            labels:
              team: "?*"

Verify image signatures (cosign):

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "registry.example.com/*"
          attestors:
            - count: 1
              entries:
                - keyless:
                    issuer: "https://token.actions.githubusercontent.com"
                    subject: "https://github.com/your-org/*"
                    rekor:
                      url: "https://rekor.sigstore.dev"

Safe Rollout Strategy

Never switch from audit to enforce without a review period:

# Step 1: Deploy policies in audit mode (log violations, don't block)
# Set validationFailureAction: Audit in all policies

# Step 2: Monitor violations for 1-2 weeks
kubectl get policyreport -A
kubectl get clusterpolicyreport

# Step 3: Review and fix all violating workloads
# Fix manifests to comply with policies

# Step 4: Switch to enforce mode
# Change validationFailureAction: Enforce in each policy

# Step 5: Monitor for blocked deployments
kubectl get events --field-selector reason=PolicyViolation -A

Handling Exceptions

For emergency deployments or legitimate exceptions:

# Exception for a specific namespace (e.g., monitoring needs host network)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - monitoring  # Prometheus needs some non-standard images
      validate:
        message: "Images must be from approved registries."
        pattern:
          spec:
            containers:
              - image: "registry.example.com/* | ghcr.io/your-org/*"

Expected Behaviour

• kubectl run test --image=ubuntu:latest returns admission error (latest tag blocked)
• Deployments without resource limits are rejected
• Images from non-allowlisted registries are blocked
• Unsigned images (when signature verification is enabled) are blocked
• Violations logged in PolicyReport resources during audit mode
• All existing workloads pass validation after remediation
• kubectl get policyreport -A shows zero violations after full rollout

Trade-offs

Failure Modes

When to Consider a Managed Alternative

Transition point: Policy libraries grow past 50 rules within months. Testing policies against all workloads before enforcement requires a staging cluster. Multi-cluster policy consistency requires centralized distribution that Kyverno/Gatekeeper OSS do not provide.

• Styra (#52) DAS: Enterprise OPA management with policy bundles, decision logging, impact analysis, and multi-cluster distribution.
• Nirmata (#53): Kyverno Enterprise with policy lifecycle management, multi-cluster policy distribution, compliance reporting, and policy-as-code CI integration.
• Snyk (#48) IaC: Scans Kubernetes manifests in CI for policy violations before deployment, complementing runtime admission control.

Premium content pack: OPA/Kyverno policy library. 50+ tested policies covering: image security (registry allowlist, tag validation, signature verification), workload security (resource limits, security context, labels), network security (require network policies per namespace), and compliance (CIS Kubernetes Benchmark controls as admission policies).