Pod Security Standards and Pod Security Admission, NetworkPolicy fundamentals with default-deny and service-to-service patterns, restricted-profile pod security contexts, and Kyverno examples. Use when hardening workloads or writing NetworkPolicy and admission rules.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# K8s Security Policies
> Pod Security Standards, NetworkPolicy patterns, admission control strategies, and workload security enforcement.
## Knowledge Base
### Pod Security Standards (PSS) -- The Three Profiles
Pod Security Standards define three progressively restrictive security profiles. These are not policies themselves -- they are standards that admission controllers enforce.
| Profile | Purpose | Restrictions |
|---------|---------|------------|
| **Privileged** | Unrestricted. For system-level workloads. | None. Everything allowed. |
| **Baseline** | Prevents known privilege escalations. Minimally restrictive. | No privileged containers, no hostPath, no hostNetwork/PID/IPC, restricted capabilities, restricted volume types, no host ports |
| **Restricted** | Heavily restricted. Best practice for untrusted workloads. | Baseline + must run as non-root, must drop ALL capabilities (may add NET_BIND_SERVICE), seccomp profile required, restricted seccomp/AppArmor profiles |
### Pod Security Admission (PSA) Controller
PSA is the built-in admission controller that enforces PSS. Three modes per namespace:
| Mode | Behavior |
|------|----------|
…
The line at the top of this page pins the label git:20260930.71a2663, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
The registry has recorded 2 versions of this file, between Feb 25, 2026 and Sep 30, 2026, about one every 218 days. Its first recorded version is graded C and its latest A.
GET https://markdownregistry.com/api/v1/artifacts/art_4dpqjuhyjhekg2hj
GET https://markdownregistry.com/api/v1/resolve?ref=hermeticormus/libresecops-claude-code/k8s-security-policies
GET https://markdownregistry.com/api/v1/blob/3ec96e33e7ca83a6635027210b19b4f530f524bf00fcaff3a119c671d7e735c2
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
hermeticormus/libresecops-claude-code · .grok/skills/verify-libre-secops/SKILL.md · Install the LibreSecOps-Claude-Code plugin pack the way a user does, into a clean Claude Code config and a clean Grok…
hermeticormus/libresecops-claude-code · plugins/api-security-testing/skills/api-auth-patterns/SKILL.md · Secure implementation patterns for API authentication and authorization: OAuth 2.0 flows, JWT best practices, API key…
hermeticormus/libresecops-claude-code · plugins/blue-team-detection/skills/threat-hunting-methodology/SKILL.md · Hypothesis-driven threat hunting framework with hunt categories, required data sources, worked hunts for DNS tunneling…
hermeticormus/libresecops-claude-code · plugins/bug-bounty-methodology/skills/vuln-report-writing/SKILL.md · Guide to vulnerability reports that get accepted and triaged: title writing, CVSS v3.1 scoring, reproduction steps…
hermeticormus/libresecops-claude-code · plugins/cloud-security-gcp/skills/gcp-iam-patterns/SKILL.md · GCP IAM reference: the permission model, role types, deny policies, least-privilege service accounts, Workload Identity…
hermeticormus/libresecops-claude-code · plugins/compliance-frameworks/skills/soc2-controls/SKILL.md · SOC 2 Type II reference: the Trust Service Criteria, Common Criteria controls, evidence requirements, a readiness…
wshobson/agents · plugins/kubernetes-operations/skills/k8s-security-policies/SKILL.md · Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
dicklesworthstone/pi_agent_rust · tests/ext_conformance/artifacts/agents-wshobson/kubernetes-operations/skills/k8s-security-policies/SKILL.md · Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
sandbaseai/sandbase-skills · marketing/k8s-security-policies/SKILL.md · Plan, implement, or review kubernetes security policies work in an existing codebase with compatibility, security, and…
hermeticormus/libreuiux-claude-code · plugins/kubernetes-operations/skills/k8s-security-policies/SKILL.md · Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
hermeticormus/claude-code-game-development · plugins/kubernetes-operations/skills/k8s-security-policies/SKILL.md · Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
rudycity/superagent · .agents/skills/k8s-security-policies/SKILL.md · Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
