Reject a privileged container with admission policy

short · 55 min · Objective 2.1

Task

Write an admission policy that refuses containers requesting privilege, host mounts or images from unapproved registries, and prove it refuses by attempting each.

Steps

  1. Stand up the cluster and confirm you can deploy a trivially privileged pod. Capture that SUCCESS in lab/admission-before.txt -- it is the baseline that makes the next step meaningful.
  2. Write admission policy rejecting: privileged mode, host path mounts, host network, containers running as root, and images from any registry other than one you nominate.
  3. Attempt all five and capture each refusal in lab/admission-deny.txt with the rule that fired.
  4. Deploy one compliant workload and confirm it is admitted.
  5. Write lab/admission-note.md explaining why namespaces are not a security boundary and what you would use instead for genuinely separate trust levels.

Verify

test -s lab/admission-before.txt && echo "baseline captured"
grep -Eic 'denied|rejected|forbidden|admission' lab/admission-deny.txt
grep -c . lab/admission-deny.txt
grep -Eci 'namespace|separate cluster|dedicated node' lab/admission-note.md

A baseline showing the deployment succeeding BEFORE the policy, five distinct refusals after it, and the note naming separate clusters or dedicated nodes. Without the baseline, a refusal could mean the manifest was simply wrong.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.