# Mapping PodSecurityPolicies to Pod Security Standards

Mapping PodSecurityPolicies to Pod Security StandardsThe tables below enumerate the configuration parameters on PodSecurityPolicy objects, whether the field mutates and/or validates pods, and how the configuration values map to the Pod Security Standards.For each applicable parameter, the allowed values for the Baseline and Restricted profiles are listed. Anything outside the allowed values for those profiles would fall under the Privileged profile. "No opinion" means all values are allowed under all Pod Security Standards.For a step-by-step migration guide, see Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller.PodSecurityPolicy SpecThe fields enumerated in this table are part of the PodSecurityPolicySpec, which is specified under the .spec field path.Mapping PodSecurityPolicySpec fields to Pod Security StandardsPodSecurityPolicySpecTypePod Security Standards EquivalentprivilegedValidatingBaseline & Restricted: false / undefined / nildefaultAddCapabilitiesMutating & ValidatingRequirements match allowedCapabilities below.allowedCapabilitiesValidatingBaseline: subset ofAUDIT_WRITECHOWNDAC_OVERRIDEFOWNERFSETIDKILLMKNODNET_BIND_SERVICESETFCAPSETGIDSETPCAPSETUIDSYS_CHROOTRestricted: empty / undefined / nil OR a list containing only NET_BIND_SERVICErequiredDropCapabilitiesMutating & ValidatingBaseline: no opinionRestricted: must include ALLvolumesValidatingBaseline: anything excepthostPath*Restricted: subset ofconfigMapcsidownwardAPIemptyDirephemeralpersistentVolumeClaimprojectedsecrethostNetworkValidatingBaseline & Restricted: false / undefined / nilhostPortsValidatingBaseline & Restricted: undefined / nil / emptyhostPIDValidatingBaseline & Restricted: false / undefined / nilhostIPCValidatingBaseline & Restricted: false / undefined / nilseLinuxMutating & ValidatingBaseline & Restricted: seLinux.rule is MustRunAs, with the following optionsuser is unset ("" / undefined / nil)role is unset ("" / undefined / nil)type is unset or one of: container_t, container_init_t, container_kvm_t, container_engine_tlevel is anythingrunAsUserMutating & ValidatingBaseline: AnythingRestricted: rule is MustRunAsNonRootrunAsGroupMutating (MustRunAs) & ValidatingNo opinionsupplementalGroupsMutating & ValidatingNo opinionfsGroupMutating & ValidatingNo opinionreadOnlyRootFilesystemMutating & ValidatingNo opiniondefaultAllowPrivilegeEscalationMutatingNo opinion (non-validating)allowPrivilegeEscalationMutating & ValidatingOnly mutating if set to falseBaseline: No opinionRestricted: falseallowedHostPathsValidatingNo opinion (volumes takes precedence)allowedFlexVolumesValidatingNo opinion (volumes takes precedence)allowedCSIDriversValidatingNo opinion (volumes takes precedence)allowedUnsafeSysctlsValidatingBaseline & Restricted: undefined / nil / emptyforbiddenSysctlsValidatingNo opinionallowedProcMountTypes(alpha feature)ValidatingBaseline & Restricted: ["Default"] OR undefined / nil / emptyruntimeClass .defaultRuntimeClassNameMutatingNo opinionruntimeClass .allowedRuntimeClassNamesValidatingNo opinionPodSecurityPolicy annotationsThe annotations enumerated in this table can be specified under .metadata.annotations on the PodSecurityPolicy object.Mapping PodSecurityPolicy annotations to Pod Security StandardsPSP AnnotationTypePod Security Standards Equivalentseccomp.security.alpha.kubernetes.io/defaultProfileNameMutatingNo opinionseccomp.security.alpha.kubernetes.io/allowedProfileNamesValidatingBaseline: "runtime/default," (Trailing comma to allow unset)Restricted: "runtime/default" (No trailing comma)localhost/* values are also permitted for both Baseline & Restricted.apparmor.security.beta.kubernetes.io/defaultProfileNameMutatingNo opinionapparmor.security.beta.kubernetes.io/allowedProfileNamesValidatingBaseline: "runtime/default," (Trailing comma to allow unset)Restricted: "runtime/default" (No trailing comma)localhost/* values are also permitted for both Baseline & Restricted.