Migrating Kubernetes namespaces toward Restricted Pod Security

The concrete problem: Kubernetes meets Pod Security Admission

The starting point is not a feature; it is an observable decision boundary.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c11 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to restricted, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by audit and Kubernetes: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c11 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Pod Security Admission into a reviewable decision point with a named input and a retained output.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c12 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. To test audit, fixture kubernetes-restricted-pod-security-migration-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to warn. Operations then observes the transition between warn and Kubernetes, while security checks that Pod Security Admission receives neither implicit authority nor unnecessary data. If the Kubernetes verification fails, rollback restores the configuration around Pod Security Admission, replays kubernetes-restricted-pod-security-migration-c12, and compares the new state with the control evidence from restricted.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c13 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to warn, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Kubernetes and restricted: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c13 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns audit into a reviewable decision point with a named input and a retained output.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c14 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. To test Kubernetes, fixture kubernetes-restricted-pod-security-migration-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Pod Security Admission. Operations then observes the transition between Pod Security Admission and restricted, while security checks that audit receives neither implicit authority nor unnecessary data. If the restricted verification fails, rollback restores the configuration around audit, replays kubernetes-restricted-pod-security-migration-c14, and compares the new state with the control evidence from warn.

Trust boundaries around restricted

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c21 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. If the Kubernetes verification fails, rollback restores the configuration around Pod Security Admission, replays kubernetes-restricted-pod-security-migration-c21, and compares the new state with the control evidence from restricted. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by warn and Pod Security Admission: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c21 is labeled as a limitation or inference, never promoted to fact.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c22 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns audit into a reviewable decision point with a named input and a retained output. To test warn, fixture kubernetes-restricted-pod-security-migration-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Kubernetes. Operations then observes the transition between Kubernetes and Pod Security Admission, while security checks that restricted receives neither implicit authority nor unnecessary data.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c23 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. If the restricted verification fails, rollback restores the configuration around audit, replays kubernetes-restricted-pod-security-migration-c23, and compares the new state with the control evidence from warn. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Kubernetes, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Pod Security Admission and audit: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c23 is labeled as a limitation or inference, never promoted to fact.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c24 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Kubernetes into a reviewable decision point with a named input and a retained output. To test Pod Security Admission, fixture kubernetes-restricted-pod-security-migration-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to restricted. Operations then observes the transition between restricted and audit, while security checks that warn receives neither implicit authority nor unnecessary data.

Prepare the starting state and prerequisites

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c31 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. Operations then observes the transition between Kubernetes and Pod Security Admission, while security checks that restricted receives neither implicit authority nor unnecessary data. If the Pod Security Admission verification fails, rollback restores the configuration around restricted, replays kubernetes-restricted-pod-security-migration-c31, and compares the new state with the control evidence from audit. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to warn, a concrete condition, and evidence instead of a generic assurance.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c32 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. The conclusion stays bounded by Pod Security Admission and audit: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c32 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns warn into a reviewable decision point with a named input and a retained output. To test Kubernetes, fixture kubernetes-restricted-pod-security-migration-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Pod Security Admission.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c33 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. Operations then observes the transition between restricted and audit, while security checks that warn receives neither implicit authority nor unnecessary data. If the audit verification fails, rollback restores the configuration around warn, replays kubernetes-restricted-pod-security-migration-c33, and compares the new state with the control evidence from Kubernetes. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Pod Security Admission, a concrete condition, and evidence instead of a generic assurance.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c34 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. The conclusion stays bounded by audit and Kubernetes: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c34 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Pod Security Admission into a reviewable decision point with a named input and a retained output. To test restricted, fixture kubernetes-restricted-pod-security-migration-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit.

1. Step 1 — Configure Kubernetes, run verification kubernetes-restricted-pod-security-migration-step-1, and retain the observable result before continuing.
2. Step 2 — Configure Pod Security Admission, run verification kubernetes-restricted-pod-security-migration-step-2, and retain the observable result before continuing.
3. Step 3 — Configure restricted, run verification kubernetes-restricted-pod-security-migration-step-3, and retain the observable result before continuing.
4. Step 4 — Configure audit, run verification kubernetes-restricted-pod-security-migration-step-4, and retain the observable result before continuing.
5. Step 5 — Configure warn, run verification kubernetes-restricted-pod-security-migration-step-5, and retain the observable result before continuing.
6. Step 6 — Configure Kubernetes, run verification kubernetes-restricted-pod-security-migration-step-6, and retain the observable result before continuing.

Execute the procedure and observe the result

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c41 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. To test Kubernetes, fixture kubernetes-restricted-pod-security-migration-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Pod Security Admission. Operations then observes the transition between Pod Security Admission and restricted, while security checks that audit receives neither implicit authority nor unnecessary data. If the restricted verification fails, rollback restores the configuration around audit, replays kubernetes-restricted-pod-security-migration-c41, and compares the new state with the control evidence from warn.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c42 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Pod Security Admission, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by restricted and warn: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c42 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Kubernetes into a reviewable decision point with a named input and a retained output.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c43 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. To test restricted, fixture kubernetes-restricted-pod-security-migration-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit. Operations then observes the transition between audit and warn, while security checks that Kubernetes receives neither implicit authority nor unnecessary data. If the warn verification fails, rollback restores the configuration around Kubernetes, replays kubernetes-restricted-pod-security-migration-c43, and compares the new state with the control evidence from Pod Security Admission.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c44 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by warn and Pod Security Admission: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c44 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns restricted into a reviewable decision point with a named input and a retained output.

Failure modes, signals, and diagnosis

The starting point is not a feature; it is an observable decision boundary.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c51 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Kubernetes into a reviewable decision point with a named input and a retained output. To test Pod Security Admission, fixture kubernetes-restricted-pod-security-migration-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to restricted. Operations then observes the transition between restricted and audit, while security checks that warn receives neither implicit authority nor unnecessary data.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c52 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. If the warn verification fails, rollback restores the configuration around Kubernetes, replays kubernetes-restricted-pod-security-migration-c52, and compares the new state with the control evidence from Pod Security Admission. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to restricted, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by audit and Kubernetes: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c52 is labeled as a limitation or inference, never promoted to fact.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c53 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns restricted into a reviewable decision point with a named input and a retained output. To test audit, fixture kubernetes-restricted-pod-security-migration-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to warn. Operations then observes the transition between warn and Kubernetes, while security checks that Pod Security Admission receives neither implicit authority nor unnecessary data.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c54 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. If the Pod Security Admission verification fails, rollback restores the configuration around restricted, replays kubernetes-restricted-pod-security-migration-c54, and compares the new state with the control evidence from audit. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to warn, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Kubernetes and restricted: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c54 is labeled as a limitation or inference, never promoted to fact.

Progressive rollout and rollback

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c61 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. The conclusion stays bounded by audit and Kubernetes: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c61 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Pod Security Admission into a reviewable decision point with a named input and a retained output. To test restricted, fixture kubernetes-restricted-pod-security-migration-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c62 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. Operations then observes the transition between warn and Kubernetes, while security checks that Pod Security Admission receives neither implicit authority nor unnecessary data. If the Kubernetes verification fails, rollback restores the configuration around Pod Security Admission, replays kubernetes-restricted-pod-security-migration-c62, and compares the new state with the control evidence from restricted. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c63 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. The conclusion stays bounded by Kubernetes and restricted: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c63 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns audit into a reviewable decision point with a named input and a retained output. To test warn, fixture kubernetes-restricted-pod-security-migration-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Kubernetes.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c64 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. Operations then observes the transition between Pod Security Admission and restricted, while security checks that audit receives neither implicit authority nor unnecessary data. If the restricted verification fails, rollback restores the configuration around audit, replays kubernetes-restricted-pod-security-migration-c64, and compares the new state with the control evidence from warn. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Kubernetes, a concrete condition, and evidence instead of a generic assurance.

Production decision criteria

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c71 starts at restricted and treats audit as an explicit boundary rather than an implicit assumption. The first control requires warn to emit an observable result before Kubernetes can trigger the intended effect around Pod Security Admission. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by warn and Pod Security Admission: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c71 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns restricted into a reviewable decision point with a named input and a retained output.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c72 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. To test warn, fixture kubernetes-restricted-pod-security-migration-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Kubernetes. Operations then observes the transition between Kubernetes and Pod Security Admission, while security checks that restricted receives neither implicit authority nor unnecessary data. If the Pod Security Admission verification fails, rollback restores the configuration around restricted, replays kubernetes-restricted-pod-security-migration-c72, and compares the new state with the control evidence from audit.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c73 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Kubernetes, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Pod Security Admission and audit: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c73 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns warn into a reviewable decision point with a named input and a retained output.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c74 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. To test Pod Security Admission, fixture kubernetes-restricted-pod-security-migration-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to restricted. Operations then observes the transition between restricted and audit, while security checks that warn receives neither implicit authority nor unnecessary data. If the audit verification fails, rollback restores the configuration around warn, replays kubernetes-restricted-pod-security-migration-c74, and compares the new state with the control evidence from Kubernetes.

Controls that remain after launch

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c81 starts at audit and treats warn as an explicit boundary rather than an implicit assumption. The first control requires Kubernetes to emit an observable result before Pod Security Admission can trigger the intended effect around restricted. If the Pod Security Admission verification fails, rollback restores the configuration around restricted, replays kubernetes-restricted-pod-security-migration-c81, and compares the new state with the control evidence from audit. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to warn, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Kubernetes and restricted: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c81 is labeled as a limitation or inference, never promoted to fact.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c82 starts at warn and treats Kubernetes as an explicit boundary rather than an implicit assumption. The first control requires Pod Security Admission to emit an observable result before restricted can trigger the intended effect around audit. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns warn into a reviewable decision point with a named input and a retained output. To test Kubernetes, fixture kubernetes-restricted-pod-security-migration-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Pod Security Admission. Operations then observes the transition between Pod Security Admission and restricted, while security checks that audit receives neither implicit authority nor unnecessary data.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c83 starts at Kubernetes and treats Pod Security Admission as an explicit boundary rather than an implicit assumption. The first control requires restricted to emit an observable result before audit can trigger the intended effect around warn. If the audit verification fails, rollback restores the configuration around warn, replays kubernetes-restricted-pod-security-migration-c83, and compares the new state with the control evidence from Kubernetes. This detail makes “Migrating Kubernetes namespaces toward Restricted Pod Security” reviewable because each operational statement points to Pod Security Admission, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by restricted and warn: anything not demonstrated by scenario kubernetes-restricted-pod-security-migration-c83 is labeled as a limitation or inference, never promoted to fact.

In “Migrating Kubernetes namespaces toward Restricted Pod Security”, scenario kubernetes-restricted-pod-security-migration-c84 starts at Pod Security Admission and treats restricted as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before warn can trigger the intended effect around Kubernetes. That sequence serves this concrete job: Use audit and warn modes to discover violations, remediate workloads and only then enforce Restricted. It turns Pod Security Admission into a reviewable decision point with a named input and a retained output. To test restricted, fixture kubernetes-restricted-pod-security-migration-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit. Operations then observes the transition between audit and warn, while security checks that Kubernetes receives neither implicit authority nor unnecessary data.

Operational checklist

• The control around Kubernetes has an input, a rule, a rejection behavior, and evidence.
• The control around Pod Security Admission has an input, a rule, a rejection behavior, and evidence.
• The control around restricted has an input, a rule, a rejection behavior, and evidence.
• The control around audit has an input, a rule, a rejection behavior, and evidence.
• The control around warn has an input, a rule, a rejection behavior, and evidence.