Overview
Legacy control: PodSecurityPolicy (PSP) was the old Kubernetes admission controller for enforcing pod security requirements. Kubernetes deprecated PSP and removed it in Kubernetes 1.25. In current GKE guidance, the replacement is Pod Security Admission and the Kubernetes Pod Security Standards.
Rationale
This control is only meaningful for older clusters that still predate the removal of PSP. For modern GKE environments, the real security objective is to enforce pod security through Pod Security Admission, restricted namespace policies, and related workload hardening controls.
Remediation guidance
Current recommendation
Do not try to enable PodSecurityPolicy on current GKE clusters. That feature was removed upstream in Kubernetes 1.25 and GKE documents migration away from PSP.
For legacy clusters that still use PSP
- Inventory existing
PodSecurityPolicyobjects and the users, service accounts, or controllers that depend on them. - Migrate those controls to Pod Security Admission labels and any supporting admission policy you require.
- Disable PSP before upgrading the cluster to versions where PSP is removed.
Example namespace labels for Pod Security Admission:
kubectl label --overwrite ns [NAMESPACE] pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/audit=restricted pod-security.kubernetes.io/warn=restricted
Validate the namespace labels:
kubectl get ns [NAMESPACE] --show-labels
Important note
This repository currently has no active automated rule for this control (rules is null). Treat it as legacy content that should eventually be replaced by modern Pod Security Admission controls rather than by a PSP enablement check.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/migrate-podsecuritypolicy
- https://kubernetes.io/docs/concepts/security/pod-security-admission/
Service-wide remediation
Recommended when many resources are affected: replace PSP-era policy with a modern pod security baseline across all namespaces and clusters.
Standardize Pod Security Admission labels, admission policy, and workload exception handling in your platform baseline so the replacement is consistent everywhere.
Operational rollout
- Identify legacy clusters and namespaces that still depend on PSP-era behavior.
- Roll out Pod Security Admission labels in audit or warn mode first, then move to enforce.
- Plan retirement of this legacy control once modern replacement controls are fully in place.
Query logic
These are the stored checks tied to this control.
No stored query bodies are attached to this entry.
