Minimize The Admission Of Privileged Containers

Manual Steps

Identify workload namespaces and existing privileged pods
Run on: any machine with kubectl access

# List namespaces (exclude obvious system ones; adjust as needed)
kubectl get ns

# List current privileged containers (for awareness)
kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
while read -r pod_name pod_namespace; do
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | \
  while read -r container; do
    container_name=$(echo "${container}" | jq -r '.name')
    container_privileged=$(echo "${container}" | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
    if [ "${container_privileged}" = "true" ]; then
      echo "NON-COMPLIANT pod=${pod_name} ns=${pod_namespace} container=${container_name}"
    fi
  done
done

Decide namespace policy scope and exceptions
Run on: administrator’s workstation (planning)
- For each workload namespace, decide whether all privileged containers must be denied, or whether specific service accounts/namespaces need an exception (for example, infrastructure tooling).
- For any allowed exceptions, plan separate namespaces or dedicated service accounts with clearly documented justification, since this control is MANUAL and risk-based.
Create a baseline policy to deny privileged containers in a namespace
Run on: any machine with kubectl access
Example using the built-in PodSecurity admission (Kubernetes ≥1.25). Replace <NAMESPACE> with an actual workload namespace and repeat for each one where privileged containers must be blocked.
kubectl label namespace <NAMESPACE> \ pod-security.kubernetes.io/enforce=restricted \ pod-security.kubernetes.io/enforce-version=latest \ pod-security.kubernetes.io/warn=restricted \ pod-security.kubernetes.io/warn-version=latest \ pod-security.kubernetes.io/audit=restricted \ pod-security.kubernetes.io/audit-version=latest --overwrite
This label set enforces the “restricted” Pod Security level, which disallows privileged containers (securityContext.privileged: true) in that namespace.

(If PodSecurity admission is not available) Apply a restrictive admission policy
Run on: any machine with kubectl access
If your cluster uses a policy engine (for example, Kubernetes-native PodSecurityPolicies on legacy clusters, or Gatekeeper/Kyverno), implement or tighten the admission policy for each workload namespace so that containers with .securityContext.privileged: true are rejected. Example Kyverno ClusterPolicy (adjust names/namespaces to your environment before applying):

cat << 'EOF' > deny-privileged-containers.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-privileged-containers
spec:
  validationFailureAction: enforce
  background: true
  rules:
    - name: disallow-privileged
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - "<NAMESPACE1>"
                - "<NAMESPACE2>"
      validate:
        message: "Privileged containers are not allowed."
        pattern:
          spec:
            containers:
              - name: "*"
                =(securityContext):
                  =(privileged): "false"
EOF

kubectl apply -f deny-privileged-containers.yaml

Review this policy with your security team before applying, and tailor namespace lists and any needed exceptions.

Refactor or remove existing privileged workloads
Run on: any machine with kubectl access
For each privileged pod identified in step 1 in user/workload namespaces:
- Retrieve and edit the manifest:
  kubectl get pod <POD_NAME> -n <NAMESPACE> -o yaml > /tmp/<POD_NAME>.yaml
- In /tmp/<POD_NAME>.yaml, remove securityContext.privileged: true from each container, or set it to false, and adjust capabilities/host access to meet functional needs without privilege.
- Recreate the workload (ideally via its Deployment/DaemonSet/Job manifests rather than directly from a Pod):
  # If the pod is managed by a controller, edit the controller instead kubectl edit deployment <DEPLOYMENT_NAME> -n <NAMESPACE> # or apply the corrected manifest kubectl apply -f /tmp/<WORKLOAD>.yaml
- Where privileged access is truly required and accepted, move such workloads into a clearly designated, tightly controlled namespace and exempt it deliberately from the restrictive policy, with documented approval.

Verify that privileged containers are no longer admitted
Run on: any machine with kubectl access

Attempt to create a test privileged pod in a protected workload namespace; it should be rejected:

cat << 'EOF' | kubectl apply -n <NAMESPACE> -f -
apiVersion: v1
kind: Pod
metadata:
  name: test-privileged
spec:
  containers:
    - name: test
      image: busybox
      command: ["sh", "-c", "sleep 3600"]
      securityContext:
        privileged: true
EOF

Confirm that any remaining running containers with privileged: true are only in explicitly approved namespaces (if any) and that user/workload namespaces are clean:

kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
while read -r pod_name pod_namespace; do
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | \
  while read -r container; do
    container_name=$(echo "${container}" | jq -r '.name')
    container_privileged=$(echo "${container}" | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
    if [ "${container_privileged}" = "true" ]; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
    fi
  done
done

Ensure that no lines with is_compliant: false appear for regular workload namespaces.

Using kubectl

# 1) Create a PodSecurity admission label set that forbids privileged containers
# Run on: any machine with kubectl access

# Example: apply to one user workload namespace (replace "my-workload-namespace" with the real name)
kubectl label namespace my-workload-namespace \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/audit-version=latest \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/warn-version=latest --overwrite

# To apply the same policy to multiple namespaces (edit the list as needed):
for ns in team-a team-b production staging; do
  kubectl label namespace "$ns" \
    pod-security.kubernetes.io/enforce=restricted \
    pod-security.kubernetes.io/enforce-version=latest \
    pod-security.kubernetes.io/audit=restricted \
    pod-security.kubernetes.io/audit-version=latest \
    pod-security.kubernetes.io/warn=restricted \
    pod-security.kubernetes.io/warn-version=latest --overwrite
done

Example restrictive policy via a (legacy) PodSecurityPolicy-like admission controller (only if your cluster still uses it and you have the controller enabled):

# Save as psp-no-privileged.yaml, then apply with:
# kubectl apply -f psp-no-privileged.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-no-privileged
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: use-restricted-no-privileged
rules:
  - apiGroups: ['policy']
    resources: ['podsecuritypolicies']
    verbs: ['use']
    resourceNames: ['restricted-no-privileged']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: use-restricted-no-privileged
  namespace: my-workload-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: use-restricted-no-privileged
subjects:
  - kind: Group
    name: system:serviceaccounts:my-workload-namespace
    apiGroup: rbac.authorization.k8s.io

# 2) Verification (no privileged containers in existing pods)
# Run on: any machine with kubectl access

kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
  do
    container_name=$(echo ${container} | jq -r '.name')
    container_privileged=$(echo ${container} | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
    if [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
    else
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
    fi
  done
done

Automation

#!/usr/bin/env bash
# Purpose: Minimize admission of privileged containers by enforcing a Pod Security policy
#          (via Pod Security admission labels) or a fallback namespace-wide PSP-like
#          restriction using a validating admission policy (for clusters that support it).
# Scope:   Runs from any machine with kubectl access and current-context set appropriately.
# Notes:   This is a MANUAL benchmark control. This script helps implement a common,
#          restrictive policy, but you must review namespaces and exceptions yourself.

set -euo pipefail

# -----------------------------
# Configuration (edit as needed)
# -----------------------------

# Namespaces to EXCLUDE from restriction (typically system/control-plane namespaces).
# Add any namespaces that legitimately require privileged containers.
EXCLUDED_NAMESPACES=(
  "kube-system"
  "kube-public"
  "kube-node-lease"
  "kube-admin"
  "kube-monitoring"
  "default"           # Remove this if you run user workloads in "default" and want it restricted
)

# Label key/value for Pod Security Admission. "restricted" blocks privileged containers.
PSA_LABEL_KEY="pod-security.kubernetes.io/enforce"
PSA_LABEL_VALUE="restricted"

# Whether to attempt creating a validating admission policy as a fallback for clusters
# without Pod Security Admission labels (set to "true" or "false").
ENABLE_VALIDATING_FALLBACK="true"

# Name/namespace for the validating admission policy resources (Kubernetes 1.27+).
VAP_NAME="deny-privileged-containers"
VAP_TEMPLATE_NAME="deny-privileged-containers-template"

# -----------------------------------
# Helpers
# -----------------------------------

kubectl_bin() {
  command -v kubectl
}

in_excluded_namespace() {
  local ns="$1"
  for e in "${EXCLUDED_NAMESPACES[@]}"; do
    if [[ "$ns" == "$e" ]]; then
      return 0
    fi
  done
  return 1
}

supports_pod_security_admission() {
  # Heuristic: check if namespace accepts pod-security.kubernetes.io/enforce label without error
  local test_ns="kube-system"
  if ! $(kubectl_bin) get ns "$test_ns" >/dev/null 2>&1; then
    return 1
  fi
  # Dry-run label; if it succeeds, assume PSA is available.
  if $(kubectl_bin) label ns "$test_ns" "${PSA_LABEL_KEY}=${PSA_LABEL_VALUE}" --dry-run=server >/dev/null 2>&1; then
    return 0
  fi
  return 1
}

kubectl_api_exists() {
  local api="$1"
  if $(kubectl_bin) api-resources --api-group="${api}" >/dev/null 2>&1; then
    return 0
  fi
  return 1
}

# -----------------------------------
# 1. Enforce Pod Security "restricted" in workload namespaces (preferred)
# -----------------------------------

enforce_pod_security_admission() {
  echo "==> Enforcing Pod Security Admission 'restricted' in workload namespaces"

  local ns
  # Get all namespaces
  mapfile -t ALL_NS < <($(kubectl_bin) get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

  for ns in "${ALL_NS[@]}"; do
    if in_excluded_namespace "$ns"; then
      echo "Skipping excluded namespace: $ns"
      continue
    fi

    # Idempotent label application
    echo "Labeling namespace '$ns' with ${PSA_LABEL_KEY}=${PSA_LABEL_VALUE}"
    $(kubectl_bin) label namespace "$ns" "${PSA_LABEL_KEY}=${PSA_LABEL_VALUE}" --overwrite >/dev/null
  done
}

# -----------------------------------
# 2. Fallback: ValidatingAdmissionPolicy to deny privileged pods (if supported)
# -----------------------------------

apply_validating_admission_policy() {
  if [[ "${ENABLE_VALIDATING_FALLBACK}" != "true" ]]; then
    echo "Validating admission fallback disabled; skipping."
    return 0
  fi

  if ! kubectl_api_exists "admissionregistration.k8s.io"; then
    echo "Cluster does not support admissionregistration.k8s.io; cannot apply validating admission policy."
    return 0
  fi

  echo "==> Applying ValidatingAdmissionPolicy to deny privileged containers (cluster-wide fallback)"

  # This policy denies creation/update of any Pod with any container.securityContext.privileged == true.
  # It is cluster-wide; you may need to refine the namespaces using matchConstraints.
  cat <<'EOF' | $(kubectl_bin) apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: deny-privileged-containers
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      operations: ["CREATE","UPDATE"]
      resources: ["pods"]
  validations:
  - expression: "!(has(object.spec.containers) && object.spec.containers.exists(c, has(c.securityContext) && c.securityContext.privileged == true))"
    message: "Privileged containers are not allowed."
  - expression: "!(has(object.spec.initContainers) && object.spec.initContainers.exists(c, has(c.securityContext) && c.securityContext.privileged == true))"
    message: "Privileged init containers are not allowed."
EOF

  # Create a binding that applies the policy cluster-wide
  cat <<'EOF' | $(kubectl_bin) apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: deny-privileged-containers-binding
spec:
  policyName: deny-privileged-containers
  validationActions: ["Deny"]
EOF
}

# -----------------------------------
# 3. Optional: Detect and report existing privileged containers
# -----------------------------------

report_existing_privileged_containers() {
  echo "==> Scanning for existing Pods with privileged containers (this does not change them)"
  $(kubectl_bin) get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
  do
    $(kubectl_bin) get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
    do
      container_name=$(echo "${container}" | jq -r '.name')
      container_privileged=$(echo "${container}" | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
      if [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
        echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
      else
        echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
      fi
    done
  done
}

# -----------------------------------
# 4. Main
# -----------------------------------

main() {
  if ! command -v jq >/dev/null 2>&1; then
    echo "jq is required for verification; please install jq and re-run."
    exit 1
  fi

  echo "==> Verifying kubectl connectivity"
  $(kubectl_bin) version --request-timeout=5s >/dev/null

  if supports_pod_security_admission; then
    enforce_pod_security_admission
  else
    echo "Pod Security Admission labels not supported (or dry-run server check failed)."
    apply_validating_admission_policy
  fi

  # Verification: rerun the supplied audit to show any remaining privileged containers.
  echo "==> Verification: listing containers and their privileged status after policy application"
  report_existing_privileged_containers

  echo "==> Completed. Review any 'is_compliant: false' lines and either:"
  echo "    - Remove 'privileged: true' from their Pod specs, or"
  echo "    - Move them into an explicitly excluded namespace and justify the exception."
}

main "$@"

Kubernetes

Kubernetes Misconfigurations

Minimize The Admission Of Privileged Containers

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation