CertGrid CertGrid
Hands-on Lab·Certified Kubernetes Application Developer

Getting a Pod Past Pod Security Admission

A namespace that refuses your Pod, read from the developer's side: what the message is asking for, where each field actually belongs, and how much of it you need at each of the three levels.

Configuration and Security Guide 32 of 44 Intermediate

Written against the versions above. Pod Security Admission is built in and on by default - there is no webhook to install. The levels are labels on the namespace.

Four nodes. Every Pod here is refused or admitted at the apiserver, so scheduling is not the subject.
Server NameIP AddressOSRolesCPURAMHDD
CKA1001192.168.0.175Ubuntu 26.04 LTSControl Plane Node2 Core4 GB50 GB
CKA1001-NODE01192.168.0.176Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA1001-NODE02192.168.0.177Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA1001-NODE03192.168.0.178Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. A namespace that refuses your Pod

  2. The four fields it asked for

  3. Prove it is really running as you asked

  4. The same Pod, in a namespace that only warns

  5. And in a namespace at baseline

Official sources

← All CKAD guides