Which label should be added to the Namespace to block any privileged Pods from being created in that Namespace?

The Kubernetes Pod Security Standards (PSS) use namespace labels to define the security level for pods running within that namespace. The baseline policy is designed to prevent known privilege escalations. A key control in the baseline profile is the disallowance of privileged containers (i.e., pods with securityContext.privileged: true). By applying the label pod-security.kubernetes.io/enforce: baseline to a namespace, the Pod Security admission controller will reject any new pods that violate this policy, effectively blocking privileged pods from being created.

A. privileged: false: This is a generic label with no inherent security enforcement behavior in Kubernetes. The admission controller would ignore it.

B. privileged: true: This is a generic label that does not enforce any security policy and is logically opposite to the goal of blocking privileged pods.

D. pod.security.kubernetes.io/privileged: false: This label does not conform to the correct syntax for Pod Security Standards, which require a mode (enforce, audit, warn) and a level (privileged, baseline, restricted).

1. Kubernetes Official Documentation

"Pod Security Standards": This document outlines the different security profiles. The "Baseline" profile section explicitly states that "Privileged containers are disallowed."

Reference: kubernetes.io/docs/concepts/security/pod-security-standards/#baseline

2. Kubernetes Official Documentation

"Enforcing Pod Security Standards": This guide details how to apply the standards using namespace labels. It provides the exact syntax for enforcement.

Reference: kubernetes.io/docs/tasks/configure-pod-container/enforce-pod-security-standards/#enforcing-pod-security-standards

3. University of California

Berkeley

CS 162 Operating Systems and System Programming

Lecture 23

"Cloud Computing III: Kubernetes": Course materials often cover Kubernetes security primitives. The principles of namespace-level security controls and admission controllers are fundamental concepts discussed.

Reference: The concept of using admission controllers and policies (like PSS) to enforce security constraints at the namespace level is a standard topic in advanced OS and cloud computing courses. (e.g.

Slides covering Kubernetes security architecture).