Chapter 8. Pod security authentication and authorization Pod security admission is an implementation of the Kubernetes pod security standards . Use pod security admission to restrict the behavior of pods. 8.1. Security context constraint synchronization with pod security standards MicroShift includes Kubernetes pod security admission . In addition to the global pod security admission control configuration, a controller exists that applies pod security admission control warn and audit labels to namespaces according to the security context constraint (SCC) permissions of the service accounts that are in a given namespace. Important Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. You can enable pod security admission synchronization on other namespaces as necessary. If an Operator is installed in a user-created openshift-* namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace. The controller examines ServiceAccount object permissions to use security context constraints in each namespace. Security context constraints (SCCs) are mapped to pod security profiles based on their field values; the controller uses these translated profiles. Pod security admission warn and audit labels are set to the most privileged pod security profile found in the namespace to prevent warnings and audit logging as pods are created. Namespace labeling is based on consideration of namespace-local service account privileges. Applying pods directly might use the SCC privileges of the user who runs the pod. However, user privileges are not considered during automatic labeling. 8.1.1. Viewing security context constraints in a namespace You can view the security context constraints (SCC) permissions in a given namespace. Prerequisites You have installed the OpenShift CLI ( oc ). Procedure To view the security context constraints in your namespace, run the following command: oc get --show-labels namespace <namespace> 8.2. Controlling pod security admission synchronization You can enable automatic pod security admission synchronization for most namespaces. System defaults are not enforced when the security.openshift.io/scc.podSecurityLabelSync field is empty or set to false . You must set the label to true for synchronization to occur. Important Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. These namespaces include: default kube-node-lease kube-system kube-public openshift All system-created namespaces that are prefixed with openshift- , except for openshift-operators By default, all namespaces that have an openshift- prefix are not synchronized. You can enable synchronization for any user-created openshift-* namespaces. You cannot enable synchronization for any system-created openshift-* namespaces, except for openshift-operators . If an Operator is installed in a user-created openshift-* namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace. The synchronized label inherits the permissions of the service accounts in the namespace. Procedure To enable pod security admission label synchronization in a namespace, set the value of the security.openshift.io/scc.podSecurityLabelSync label to true . Run the following command: USD oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=true Note You can use the --overwrite flag to reverse the effects of the pod security label synchronization in a namespace.

Commands:
get --show-labels namespace <namespace>
oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=true