Description
The allowedCapabilities field in a PodSecurityPolicy permits containers to request additional Linux capabilities. The list does not automatically grant them to every container, but unnecessary entries or * broaden the permissions workloads can use.
PSP was deprecated in Kubernetes 1.21 and removed in 1.25. Use supported policy controls such as Pod Security Admission in current environments.
Potential impact
- If a compromised container abuses additional capabilities, the effect on processes, networking or the host depends on the capabilities granted.
- Broad permission makes it harder to identify and control the privileges a workload actually needs.
Remediation
- Remove unnecessary capability allowances and approve only capabilities required for functionality.
- Also review removal of default capabilities and restrictions on privileged execution and privilege escalation.
- Test that required functionality works and unapproved requests for additional capabilities are rejected.
Examples
These examples compare selected fields in a legacy PSP. They are incomplete policies and cannot be applied unchanged to current clusters.
Before
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: privileged
spec:
allowedCapabilities:
- "*"
The * entry allows requests for any additional capability, creating a very broad permission scope.
After
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: privileged
spec:
volumes:
- "*"
The additional-capability allow-list is omitted. This alone does not drop all default capabilities; the broad volume permission in volumes: ["*"] also needs separate restriction.