> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Namespaces Should Enforce Pod Security Admission Baseline Or Stricter

### More Info:

Verifies each namespace is labeled with pod-security.kubernetes.io/enforce set to baseline or restricted so the built-in Pod Security Admission controller rejects unsafe pods.

### Risk Level

High

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. Identify noncompliant namespaces (run on any machine with kubectl access):
           ```sh theme={null}
           kubectl get namespaces -o json | jq -r '
             [ .items[]
             | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
             | .metadata as $m
             | (($m.labels // {})["pod-security.kubernetes.io/enforce"] // "") as $lvl
             | select($lvl != "baseline" and $lvl != "restricted")
             | .name ][]'
           ```

        2. Choose the desired enforcement level for each namespace:
           * Use `baseline` to allow most workloads while blocking known unsafe patterns.
           * Use `restricted` for the strongest isolation where workloads can comply.

        3. Label a single namespace to enforce `baseline` (run on any machine with kubectl access):
           ```sh theme={null}
           kubectl label namespace NAMESPACE_NAME pod-security.kubernetes.io/enforce=baseline --overwrite
           ```

        4. Or label a single namespace to enforce `restricted`:
           ```sh theme={null}
           kubectl label namespace NAMESPACE_NAME pod-security.kubernetes.io/enforce=restricted --overwrite
           ```

        5. Optionally label multiple namespaces at once (example with baseline):
           ```sh theme={null}
           kubectl label namespace ns1 ns2 ns3 pod-security.kubernetes.io/enforce=baseline --overwrite
           ```

        6. Verify compliance (run on any machine with kubectl access):
           ```sh theme={null}
           kubectl get namespaces -o json | jq -r '
             [ .items[]
             | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
             | .metadata as $m
             | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
             | (($m.labels // {})["pod-security.kubernetes.io/enforce"] // "") as $lvl
             | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
               + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
               + (if $labels == "" then "" else " labels=\($labels)" end)
               + " enforce=\(if $lvl == "" then "none" else $lvl end)"
               + " is_compliant=\(if ($lvl == "baseline" or $lvl == "restricted") then "true" else "false" end)"
             ] as $rows
             | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'
           ```
           Confirm that all relevant namespaces show `enforce=baseline` or `enforce=restricted` and `is_compliant=true`.
      </Accordion>

      <Accordion title="Using kubectl">
        On any machine with kubectl access:

        1. Identify noncompliant namespaces

        ```bash theme={null}
        kubectl get ns -o json | jq -r '
          [ .items[]
          | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
          | .metadata as $m
          | (($m.labels // {})["pod-security.kubernetes.io/enforce"] // "") as $lvl
          | select($lvl != "baseline" and $lvl != "restricted")
          | .name
          ] | .[]'
        ```

        2. Label each target namespace to enforce `baseline` (adjust names as needed; use `restricted` instead if you choose that policy):

        ```bash theme={null}
        kubectl label namespace my-app-namespace \
          pod-security.kubernetes.io/enforce=baseline \
          --overwrite

        kubectl label namespace another-namespace \
          pod-security.kubernetes.io/enforce=baseline \
          --overwrite
        ```

        For many namespaces at once:

        ```bash theme={null}
        for ns in $(kubectl get ns --no-headers | awk '!/kube-system|kube-public|kube-node-lease/ {print $1}'); do
          kubectl label namespace "$ns" \
            pod-security.kubernetes.io/enforce=baseline \
            --overwrite
        done
        ```

        3. Verification

        Run the same audit used by the check:

        ```bash theme={null}
        kubectl get namespaces -o json | jq -r '
          [ .items[]
          | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
          | .metadata as $m
          | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
          | (($m.labels // {})["pod-security.kubernetes.io/enforce"] // "") as $lvl
          | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
            + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
            + (if $labels == "" then "" else " labels=\($labels)" end)
            + " enforce=\(if $lvl == "" then "none" else $lvl end)"
            + " is_compliant=\(if ($lvl == "baseline" or $lvl == "restricted") then "true" else "false" end)"
          ] as $rows
          | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'
        ```
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Enforce Pod Security Admission baseline (or restricted) on all
        # non-excluded namespaces in an OKE cluster.
        #
        # Requirements:
        #   - Run on any machine with kubectl access and jq installed.
        #   - Current kubeconfig context points to the target OKE cluster.
        #
        # Behavior:
        #   - Skips kube-system, kube-public, kube-node-lease.
        #   - For namespaces without an enforce label, sets baseline.
        #   - For namespaces already labeled baseline or restricted, leaves as-is.
        #   - For namespaces with another value, updates to baseline.
        #   - Safe to re-run (idempotent).
        set -euo pipefail

        echo "[INFO] Detecting namespaces without compliant Pod Security enforce label..."

        # Get list of candidate namespaces (excluding the system namespaces)
        mapfile -t NAMESPACES < <(
          kubectl get ns -o json | jq -r '
            .items[]
            | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
            | .metadata.name
          '
        )

        if [ "${#NAMESPACES[@]}" -eq 0 ]; then
          echo "[INFO] No user namespaces found."
        else
          for ns in "${NAMESPACES[@]}"; do
            current_level="$(
              kubectl get ns "$ns" -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}' 2>/dev/null || true
            )"

            case "$current_level" in
              baseline|restricted)
                echo "[INFO] Namespace '$ns' already compliant (enforce=$current_level), skipping."
                ;;
              *)
                echo "[INFO] Setting Pod Security enforce level to 'baseline' on namespace '$ns' (was: '${current_level:-none}')."
                kubectl label namespace "$ns" \
                  "pod-security.kubernetes.io/enforce=baseline" \
                  --overwrite
                ;;
            esac
          done
        fi

        echo "[INFO] Verification: running compliance audit..."

        kubectl get namespaces -o json | jq -r '
          [ .items[]
          | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
          | .metadata as $m
          | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
          | (($m.labels // {})["pod-security.kubernetes.io/enforce"] // "") as $lvl
          | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
            + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
            + (if $labels == "" then "" else " labels=\($labels)" end)
            + " enforce=\(if $lvl == "" then "none" else $lvl end)"
            + " is_compliant=\(if ($lvl == "baseline" or $lvl == "restricted") then "true" else "false" end)"
          ] as $rows
          | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end
        '
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>