Pod security admission and security context constraints

Pod security admission and security context constraints operate as two independent mechanisms in Red Hat OpenShift Container Platform. You must ensure your workloads comply with both to avoid unexpected pod rejections.

The two controllers independently enforce security policies by using the following processes:

  1. The security context constraint controller may mutate some security context fields per the pod’s assigned SCC. For example, if the seccomp profile is empty or not set and if the pod’s assigned SCC enforces seccompProfiles field to be runtime/default, the controller sets the default type to RuntimeDefault.

  2. The security context constraint controller validates the pod’s security context against the matching SCC.

  3. The pod security admission controller validates the pod’s security context against the pod security standard assigned to the namespace.

← Previous: Privileged namespaces | ↑ Up: About pod security admission | ⌂ Home: Red Hat OpenShift Container Platform | Next: About pod security admission synchronization →