# Kubernetes workloads and admission security

A running Pod is not a secure Pod. Inspect effective security context across regular, init and helper containers and the admission policy actually enforced.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## User and privilege boundaries

Non-root execution, privileged mode and privilege escalation are separate decisions. Inspect whether containers override Pod security context. Seccomp, capabilities and host namespaces create additional boundaries. Read-only root filesystem is an extra workshop requirement, not a universal Restricted PSS requirement. Design required writable paths through controlled volumes instead of making the entire root writable or enabling privileged mode to resolve errors.

## Admission and existing workloads

Warn and audit provide visibility; they are not enforce behavior. Record policy version and who can change namespace labels. Do not assume new-Pod admission policy automatically corrects existing workloads. Bind exceptions to a workload, expiry and owner; do not blindly apply an application profile to system add-ons. Verify version-appropriate behavior with allowed and denied synthetic examples against the actual API server.

## Exact scope of the local inspector

The downloadable tool reads selected fields in apps/v1 Linux Deployment JSON examples. It checks regular, init and ephemeral lists using the same rules and reports host mounts, token automount and container conditions separately. It does not verify full API schema, PSS conformance, signatures, CNI, live admission or whether the image actually starts non-root. Matched means a configuration comparison against this limited teaching profile. No JSON is applied and no cluster credentials are read.

## Worked example: the overlooked init container

The main web container is constrained, but a setup init container is added without security fields. Do not generalize a green main-container result to the entire Pod. The weak fixture produces separate init findings; the bounded fixture matches nine selected checks. If adding an init container for real, complete its context, filesystem permissions and functional tests separately. Manifest digest, admission response and running image/Pod identity must refer to the same revision; nine local results do not replace that evidence.

## Working sequence

1. Inventory the workload and every container.
2. Review effective security context.
3. Verify admission mode and version.
4. Run allowed/denied and functional tests.
5. Bind manifest evidence to the running revision.

## 1. Is running enough?

running is a functional signal. Require non-root, no privileged mode and no privilege escalation together; test actual image startup separately.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.running
```

### Corrected implementation
```js
s=>s.running&&s.runAsNonRoot&&!s.privileged&&!s.allowPrivilegeEscalation
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "bounded-workload",
      "input": {
        "running": true,
        "runAsNonRoot": true,
        "privileged": false,
        "allowPrivilegeEscalation": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "root-workload",
      "input": {
        "running": true,
        "runAsNonRoot": false,
        "privileged": false,
        "allowPrivilegeEscalation": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "privileged",
      "input": {
        "running": true,
        "runAsNonRoot": true,
        "privileged": true,
        "allowPrivilegeEscalation": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "bounded-workload",
      "input": {
        "running": true,
        "runAsNonRoot": true,
        "privileged": false,
        "allowPrivilegeEscalation": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "root-workload",
      "input": {
        "running": true,
        "runAsNonRoot": false,
        "privileged": false,
        "allowPrivilegeEscalation": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "privileged",
      "input": {
        "running": true,
        "runAsNonRoot": true,
        "privileged": true,
        "allowPrivilegeEscalation": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. The overlooked helper

Hardening the main container does not cover init or sidecars. HostPath introduces a separate host-access boundary. Require evidence for every workload component.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.mainHardened
```

### Corrected implementation
```js
s=>s.mainHardened&&s.initHardened&&s.sidecarHardened&&!s.hostPath
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "all-containers",
      "input": {
        "mainHardened": true,
        "initHardened": true,
        "sidecarHardened": true,
        "hostPath": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "overlooked-init",
      "input": {
        "mainHardened": true,
        "initHardened": false,
        "sidecarHardened": true,
        "hostPath": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "host-mount",
      "input": {
        "mainHardened": true,
        "initHardened": true,
        "sidecarHardened": true,
        "hostPath": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "all-containers",
      "input": {
        "mainHardened": true,
        "initHardened": true,
        "sidecarHardened": true,
        "hostPath": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "overlooked-init",
      "input": {
        "mainHardened": true,
        "initHardened": false,
        "sidecarHardened": true,
        "hostPath": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "host-mount",
      "input": {
        "mainHardened": true,
        "initHardened": true,
        "sidecarHardened": true,
        "hostPath": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Warning or enforcement?

A warn label does not prove blocking. Require enforcement, pinned policy version, existing-workload review and owned exceptions; test actual API behavior separately.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.warnEnabled
```

### Corrected implementation
```js
s=>s.enforceEnabled&&s.versionPinned&&s.existingWorkloadsReviewed&&s.exceptionOwned
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "enforced-and-reviewed",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": true,
        "versionPinned": true,
        "existingWorkloadsReviewed": true,
        "exceptionOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "warnings-only",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": false,
        "versionPinned": true,
        "existingWorkloadsReviewed": true,
        "exceptionOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "old-workloads-unreviewed",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": true,
        "versionPinned": true,
        "existingWorkloadsReviewed": false,
        "exceptionOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "enforced-and-reviewed",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": true,
        "versionPinned": true,
        "existingWorkloadsReviewed": true,
        "exceptionOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "warnings-only",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": false,
        "versionPinned": true,
        "existingWorkloadsReviewed": true,
        "exceptionOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "old-workloads-unreviewed",
      "input": {
        "warnEnabled": true,
        "enforceEnabled": true,
        "versionPinned": true,
        "existingWorkloadsReviewed": false,
        "exceptionOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Manifest digest and security fields for all containers
- Actual admission/startup responses and exception record

## References

- [Kubernetes · Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
- [Kubernetes · Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)