About pod security admission

You can use pod security admission modes, such as enforce, warn, or audit, along with security profiles to restrict which pods run in your cluster. You can apply this control at both the global and namespace levels.

Globally, the privileged profile is enforced, and the restricted profile is used for warnings and audits.

You can also configure the pod security admission settings at the namespace level.

Important

Do not run workloads in or share access to default projects. Default projects are reserved for running core cluster components.

The following default projects are considered highly privileged: default, kube-public, kube-system, openshift, openshift-infra, openshift-node, and other system-created projects that have the openshift.io/run-level label set to 0 or 1. Functionality that relies on admission plugins, such as pod security admission, security context constraints, cluster resource quotas, and image reference resolution, does not work in highly privileged projects.

← Previous: Reference of security context constraints commands | ↑ Up: Control workload privileges and running permissions | ⌂ Home: Red Hat OpenShift Container Platform | Next: Pod security admission modes →