DevOps Daily with Fexingo · 2026-07-22 · 10 min
In DevOps Daily Episode 127, Lucas and Luna explore how Kubernetes Pod Security Standards (PSS) can block common supply chain attack vectors. They dissect a real-world scenario where a compromised container image from a public registry tries to escalate privileges via hostPath mounts. Lucas explains the three PSS levels - Privileged, Baseline, and Restricted - and how migrating from the deprecated PodSecurityPolicy to PSS with admission controllers like Kyverno or OPA Gatekeeper can enforce least-privilege policies. They also discuss the attack path where a malicious sidecar container bypasses classic security scans, and how PSS's 'Restricted' profile catches privilege escalation at admission time. The hosts share migration tips, common pitfalls (like blocking legitimate workloads), and why PSS adoption is accelerating as Kubernetes 1.25+ removes PSP. A must-listen for platform engineers and security-conscious DevOps teams.
How Kubernetes Namespace Quotas Trigger Unexpected Failures58 / 100Why Your Kubernetes Cost Reports Are Lying To YouHow Kubernetes Node Pools Can Cost You More Than You ThinkHow Kubernetes Pod Overhead Changes Node Capacity CalculationsHow Kubernetes Pod Security Admission Blocks Risky Workloads