Skip to content

docs: clarify NetworkPolicy and pod security guidance (#2847) - #2851

Open
bhushan4work wants to merge 1 commit into
OWASP:masterfrom
bhushan4work:fix#2847
Open

docs: clarify NetworkPolicy and pod security guidance (#2847)#2851
bhushan4work wants to merge 1 commit into
OWASP:masterfrom
bhushan4work:fix#2847

Conversation

@bhushan4work

@bhushan4work bhushan4work commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

You're A Rockstar

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

  • In case of a new Cheat Sheet, you have used the [Cheat Sheet template](../templates/New_CheatSheet.md).
  • All the markdown files do not raise any validation policy violation, see the policy.
  • All the markdown files follow these [format rules](../CONTRIBUTING.md#markdown).
  • All your assets are stored in the assets folder.
  • All the images used are in the PNG format.
  • Any references to websites have been formatted as [TEXT](URL).
  • You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
  • The CI build of your PR pass, see the build status [here](https://github.com/OWASP/CheatSheetSeries/actions).

Scope and sourcing (required)

  • This PR is focused: it modifies a single cheat sheet, or a small coordinated set, and the scope is described in the PR body.
  • Every technical claim, recommendation, or threat assertion added in this PR is supported by a primary source (RFC, NIST, OWASP standard, vendor documentation, peer-reviewed research) linked inline as [text](URL).
  • I have read each source I cite and confirm it actually supports the claim. I have not relied on summaries, hearsay, or model-generated citations.

This PR fixes issue #2847.

AI Tool Usage Disclosure (required for all PRs)

Please select exactly one of the following options. PRs that leave this section blank will be closed.

  • I have NOT used any AI tool to generate the contents of this PR.
  • I have used AI tools to generate the contents of this PR. I have verified
    the contents and I affirm the results. The LLM used is [llm name and version]
    and the prompt used is [your prompt here]. I have independently verified every citation and technical claim against the cited source. [Feel free to add more details if needed]

Thank you again for your contribution 😃

@bhushan4work
Update NetworkPolicy and Pod security guidance in Kubernetes cheat sh…
e5f34a9 
…eet (OWASP#2847)

- Replace overclaiming NetworkPolicy wording with precise Layer 3/4 ingress and egress controls, noting enforcement plugin and encryption/authentication limits

- Remove obsolete PodSecurityPolicy subsection, deprecation warning, and outdated PSP documentation reference

- Integrate workload hardening recommendations into Pod Security Standards and Pod Security Admission guidance without claiming PSA/PSS enforce controls outside their defined profiles
randomstuff
randomstuff approved these changes Oct 24, 2026
View reviewed changes
Comment thread cheatsheets/Kubernetes_Security_Cheat_Sheet.md
- **Baseline**: Minimally restrictive policy designed for common containerized workloads while preventing known privilege escalations. Targeted at developers and operators of non-critical applications. The most dangerous securityContext settings, such as securityContext.privileged, hostPID, hostPath, hostIPC, are not permitted.
- **Restricted**: The most restrictive policy, designed to enforce current Pod hardening practices at the expense of some compatibility. Intended for security critical workloads or untrusted users. Restricted includes all of the enforcements from the baseline policy, in addition to much more restrictive requirements, such as requiring the dropping of all capabilities, enforcing runAsNotRoot, and more.
- **Privileged**: Unrestricted, allows for known privilege escalations. Intended for use with system and infrastructure level workloads that require privilege to operate properly. All securityContext settings are permitted.
- **Baseline**: Minimally restrictive policy designed for common containerized workloads while preventing known privilege escalations. It restricts the most dangerous settings, enforcing default (masked) `/proc` mounts, restricting SELinux options, and prohibiting privileged containers (`securityContext.privileged`), `hostPath` volumes, and host networking or process namespaces (`hostNetwork`, `hostPID`, `hostIPC`). Note that [NetworkPolicy behavior for `hostNetwork` Pods depends on the network plugin](https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-and-hostnetwork-pods); verify enforcement rather than assuming these Pods receive the same isolation as other Pods.

@randomstuff randomstuff Oct 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this would be clearer?

you should verify enforcement rather than assuming these Pods receive the same isolation as other Pods.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@randomstuff randomstuff randomstuff approved these changes
@mackowski mackowski Awaiting requested review from mackowski mackowski is a code owner
@jmanico jmanico Awaiting requested review from jmanico jmanico is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bhushan4work @randomstuff