How do Kubernetes namespaces impact the application of policies when using Pod Security Admission?

Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces Pod Security Standards. Its configuration is managed at the namespace level through the use of labels. By applying specific labels to a namespace, administrators can define which policy level (privileged, baseline, or restricted) should be enforced, audited, or warned against for pods created within that namespace. This mechanism allows for granular control, enabling different security postures for different workloads across the cluster. For example, a namespace for system components might allow privileged pods, while an application namespace enforces the restricted standard.

A. Namespaces are ignored; Pod Security Admission policies apply cluster-wide only.

This is incorrect. Pod Security Admission is explicitly designed to be configured on a per-namespace basis using labels, which is its primary mode of operation.

C. Each namespace can have only one active policy.

This is incorrect. A namespace can have policies for three different modes (enforce, audit, warn) active simultaneously, each potentially set to a different security level.

D. The default namespace enforces the strictest security policies by default.

This is incorrect. If a namespace (including default) is not explicitly labeled, the cluster-wide defaults apply, which typically do not enforce the strictest (restricted) policy.

1. Kubernetes Documentation

"Pod Security Admission": This official documentation is the primary source. It states

"Pod Security admission is configured at the namespace level by adding labels to individual namespaces." It details how to apply labels for enforce

audit

and warn modes.

Reference Section: Configuring Pod Security Admission for a Namespace.

2. Kubernetes Documentation

"Pod Security Standards": This page describes the different policy levels (Privileged

Baseline

Restricted) that are applied to namespaces via the Pod Security Admission controller.

Reference Section: Policy Instantiation.

3. University of California

Berkeley

CS 162: Operating Systems and System Programming

Lecture 23: Cloud Computing (Kubernetes): Course materials often cover Kubernetes architecture

including the role of namespaces for isolation and policy application. Namespaces are fundamental to applying distinct configurations

including security policies

to different sets of resources within a single cluster.

Reference Concept: The lecture slides discuss namespaces as a mechanism for resource isolation and scoping

which is the foundational principle upon which per-namespace policy application

like PSA

is built. (Note: Specific page numbers vary by semester offering

but the concept is a core part of Kubernetes instruction).