Security context in Kubernetes

Question

Under the K8s component Statefulset as shown below, the security context works fine for Kubernetes 1.21 version, but when I tried with new versions it did not work fine. I understand this is due to the fact that there is 'PodSecurityPolicy deprecation' in the latest versions. But I am unable to find an alternative on how to use ' securityContext: fsGroup: 1001 ' in the yaml file. Appreciate any guidance on this ?

enter image description here

Answer 1

The recommendation from the Kubernetes official documentation, is migrating to Pod Security Admission.

Unfortunately, the migration is not as easy as just changing a particular line on a manifest, it will take a very detailed process since it could lead to a production outage or to a security gap.

In the Migrate from PSP documentation, you can find an overall approach to accomplish a successful migration:

There are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security Admission. The following steps are one possible migration path, with a goal of minimizing both the risks of a production outage and of a security gap.

0. Decide whether Pod Security Admission is the right fit for your use case.
1. Review namespace permissions
2. Simplify & standardize PodSecurityPolicies
3. Update namespaces
   1. Identify an appropriate Pod Security level
   2. Verify the Pod Security level
   3. Enforce the Pod Security level
   4. Bypass PodSecurityPolicy
4. Review namespace creation processes
5. Disable PodSecurityPolicy