---
title: Pod Security
sidebar_label: Pod Security
---

Besides restricting pod resources, it's also necessary to disallow certain potential harmful pod configurations, such as privileged pods or pods that use hostPath.
If you are using Kubernetes v1.23 or higher, you can restrict the namespace where the virtual cluster is running in via the [Pod Security Admission Controller](https://kubernetes.io/docs/concepts/security/pod-security-admission/):

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: my-vcluster-namespace
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
```

To see all supported levels and modes, please take a look at the [Kubernetes docs](https://kubernetes.io/docs/concepts/security/pod-security-standards/).

If you are using below Kubernetes v1.23 clusters, you can use the deprecated [PodSecurityPolicies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) to disallow critical workloads.

If you want more control over this, you can also use an admission controller, that let's you define your own policies, such as [OPA](https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/), [jsPolicy](https://www.jspolicy.com/) or [Kyverno](https://kyverno.io/).