How do you secure workloads on Kubernetes? Explain Pod Security Standards and securityContext.

Summary

Run containers as non-root, drop Linux capabilities, disallow privilege escalation, use a read-only root filesystem and a seccomp profile, and enforce these with the Pod Security Standards (privileged, baseline, restricted) through Pod Security Admission labels on namespaces, or with a policy engine.

Longer Answer

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities: { drop: ["ALL"] }
  seccompProfile: { type: RuntimeDefault }

PodSecurityPolicy was removed in Kubernetes 1.25; Pod Security Admission replaced it (pod-security.kubernetes.io/enforce: restricted on a namespace). For custom rules (approved registries, required labels, no latest tags) use Kyverno, OPA Gatekeeper, or built-in ValidatingAdmissionPolicy. Add image scanning and signing, NetworkPolicies, and RBAC for defence in depth.

Key Points

• Non-root, drop capabilities, read-only FS, seccomp.
• Pod Security Admission levels per namespace.
• PSP removed in 1.25.
• Kyverno/Gatekeeper/ValidatingAdmissionPolicy for custom rules.