Hands-on Lab·Certified Kubernetes Application Developer
Getting a Pod Past Pod Security Admission
A namespace that refuses your Pod, read from the developer's side: what the message is asking for, where each field actually belongs, and how much of it you need at each of the three levels.
Configuration and Security Guide 32 of 44 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 16 min
Pod Security Admission is built in and on by default - there is no webhook to install. The levels are labels on the namespace.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a namespace refuses your Pod at admission. This matters because the rejection lists exactly which fields it wanted, and the identical manifest is accepted, warned about, or rejected depending only on the namespace's label.
- meeting a namespace that refuses an ordinary Pod, and reading what it asked for
- supplying the four fields the restricted profile requires
- proving the container really is running as asked, since admission only read the manifest
- applying the same Pod to a namespace set to
warn, and watching it be admitted anyway - applying it at
baseline, and seeing how the three levels actually differ
Before you start
- guide 54 - the same fields, from the runtime side.
-
A namespace that refuses your Pod
-
The four fields it asked for
-
Prove it is really running as you asked
-
The same Pod, in a namespace that only warns
-
And in a namespace at baseline