CME-706
Pod Security Standards (Restricted)
Description
Kubernetes Pod Security Standards at Restricted level: requires non-root, drops ALL capabilities, blocks privilege escalation, requires seccomp, blocks hostPath/hostNetwork/hostPID.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Pod cannot access host resources or escalate to host context |
| Privileges Required (PR) | L → H | Non-root, no privilege escalation, minimal capabilities |
CWE Relationships
Verification
Check namespace PSS enforcement label
$ kubectl get namespace <ns> -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}'
# Expected: restricted
# Expected: restricted
Platform: kubernetes
$ kubectl get namespace <ns> -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce-version}'
# Expected: latest (or a specific version such as v1.28)
# Expected: latest (or a specific version such as v1.28)
Platform: kubernetes
$ kubectl run cme-pss-test --image=busybox --restart=Never --dry-run=server --overrides='{"spec":{"containers":[{"name":"test","image":"busybox","securityContext":{"runAsNonRoot":false,"allowPrivilegeEscalation":true}}]}}' -n <ns> 2>&1 | grep -c -i 'forbidden\|violated'
# Expected: >=1 (restricted PSS rejects non-compliant workloads)
# Expected: >=1 (restricted PSS rejects non-compliant workloads)
Platform: kubernetes
$ kubectl get namespace <ns> -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/warn}'
# Expected: restricted
# Expected: restricted
Platform: kubernetes
Remediation
kubernetes
Kubernetes Pod Security Standards restricted enforcement via namespace labels
kubectl label namespace <namespace> pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/enforce-version=latest pod-security.kubernetes.io/warn=restricted pod-security.kubernetes.io/audit=restricted --overwrite