Overview
A Pod Security Policy is a cluster-level resource that controls security sensitive aspects of the pod specification. The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system, as well as defaults for the related fields.
Rationale
The PodSecurityPolicy defines a set of conditions that Pods must meet to be accepted by the cluster; when a request to create or update a Pod does not meet the conditions in the PodSecurityPolicy, that request is rejected and an error is returned. The PodSecurityPolicy admission controller validates requests against available PodSecurityPolicies. PodSecurityPolicies specify a list of restrictions, requirements, and defaults for Pods created under the policy.
Remediation guidance
Using Command Line
To enable Pod Security Policy for an existing cluster, run the following command:
gcloud beta container clusters update \[CLUSTER_NAME\] --zone \[COMPUTE_ZONE\] --enable-pod-security-policy
Impact
If you enable the PodSecurityPolicy controller without first defining and authorizing any actual policies, no users, controllers, or service accounts can create or update Pods. If you are working with an existing cluster, you should define and authorize policies before enabling the controller.
Default Value
By default, Pod Security Policy is disabled when you create a new cluster.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies 2. https://kubernetes.io/docs/concepts/policy/pod-security-policy
Notes
This is a Beta release of PodSecurityPolicies in Kubernetes Engine. This feature is not covered by any SLA or deprecation policy and might be subject to backward-incompatible changes.
Google Cloud Console (Asset-Level)
- Open the affected project/resource from the finding details in Google Cloud Console.
- Navigate to the resource security/configuration settings.
- Apply the control-specific secure configuration.
- Save and re-run the check.
Multiple Remediation Paths
Google Cloud
SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
gcloud org-policies set-policy policy.yaml
ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.
PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
gcloud org-policies set-policy policy.yaml
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
No stored query bodies are attached to this entry.
