<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Pod Security Standards — API Reference

## kubectl PSA Labels

```bash
# Apply enforce label
kubectl label namespace NAMESPACE pod-security.kubernetes.io/enforce=LEVEL

# Apply warn label
kubectl label namespace NAMESPACE pod-security.kubernetes.io/warn=LEVEL

# Apply audit label
kubectl label namespace NAMESPACE pod-security.kubernetes.io/audit=LEVEL

# Remove label
kubectl label namespace NAMESPACE pod-security.kubernetes.io/enforce-

# Dry-run evaluation
kubectl label --dry-run=server --overwrite namespace NAMESPACE \
  pod-security.kubernetes.io/enforce=LEVEL
```

## PSS Levels

| Level | hostNetwork | privileged | runAsNonRoot | Capabilities |
|-------|------------|------------|-------------|-------------|
| Privileged | allowed | allowed | not required | all allowed |
| Baseline | denied | denied | not required | limited set |
| Restricted | denied | denied | required | drop ALL |

## Kyverno CLI

```bash
# Test policy against resource
kyverno apply policy.yaml --resource pod.yaml

# Validate cluster resources
kyverno apply policy.yaml --cluster

# Generate policy report
kyverno apply policy.yaml --resource pod.yaml -o json
```

## OPA Gatekeeper CLI

```bash
# Install Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

# List constraints
kubectl get constraints

# List constraint templates
kubectl get constrainttemplates

# Check violations
kubectl get constraints -o json | jq '.items[].status.violations'
```

## Key Pod Security Fields

| Field | Restricted Requirement |
|-------|----------------------|
| `spec.containers[].securityContext.runAsNonRoot` | Must be true |
| `spec.containers[].securityContext.privileged` | Must be false |
| `spec.containers[].securityContext.allowPrivilegeEscalation` | Must be false |
| `spec.containers[].securityContext.capabilities.drop` | Must include ALL |
| `spec.containers[].securityContext.seccompProfile.type` | RuntimeDefault or Localhost |
| `spec.hostNetwork` | Must be false |
| `spec.hostPID` | Must be false |
| `spec.hostIPC` | Must be false |
