kubernetes security_error ai_generated true

Error from server (Forbidden): pods are forbidden: violates PodSecurity

ID: kubernetes/k8s-pod-security-admission

Also available as: JSON · Markdown

88%Fix Rate

90%Confidence

55Evidence

2023-01-01First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
8	active	—	—	—

Pod Security Admission controller rejects pod because it violates the namespace's security standard (restricted, baseline, or privileged).

generic

92% success Fix the pod spec to comply with the security standard: remove privileged, runAsRoot, hostNetwork, etc.
```
Set securityContext.runAsNonRoot: true, securityContext.allowPrivilegeEscalation: false, drop ALL capabilities
```
Sources: https://kubernetes.io/docs/concepts/security/pod-security-standards/
85% success Use 'warn' or 'audit' mode instead of 'enforce' during migration
```
kubectl label namespace <ns> pod-security.kubernetes.io/enforce=baseline pod-security.kubernetes.io/warn=restricted
```
Sources: https://kubernetes.io/docs/concepts/security/pod-security-admission/

Common approaches that don't work:

Set the namespace to privileged security level 70% fail
Removes security controls — defeats the purpose of Pod Security Standards
Disable Pod Security Admission entirely 85% fail
Cluster-wide security regression — not recommended for production

Leads to:

Preceded by:

Frequently confused with: