Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

Kube Guard | Admission Policy Evaluation

Kubernetes admission controller model that evaluates pod specifications against the restricted Pod Security Standard plus operational rules, rendering deny, warn, and pass verdicts with the enforcement and audit-mode difference made explicit.

Live demo readyKubernetes + Admission Control
KubernetesAdmission ControlPod SecurityCloud NativePolicy as CodeContainer SecurityCase study / interactive demo

Case study

From problem to working system

Problem

Kubernetes admission controller model that evaluates pod specifications against the restricted Pod Security Standard plus operational rules, rendering deny, warn, and pass verdicts with the enforcement and audit-mode difference made explicit.

My role

Security engineer and full-stack developer

Solution

Kubernetes admission controller model that evaluates pod specifications against the restricted Pod Security Standard plus operational rules, rendering deny, warn, and pass verdicts with the enforcement and audit-mode difference made explicit.

Architecture

The implementation combines the following technologies and system concerns.

KubernetesAdmission ControlPod SecurityCloud NativePolicy as CodeContainer Security

How it was built

  • Modelled audit mode alongside enforcement, showing exactly what a non-enforcing cluster is currently accepting.

Security decisions

  • Evaluated pod specs against the restricted Pod Security Standard controls that matter most: privileged mode, host namespaces, hostPath mounts, root execution, and added capabilities.
  • Modelled audit mode alongside enforcement, showing exactly what a non-enforcing cluster is currently accepting.

Major challenges

  • Evaluated pod specs against the restricted Pod Security Standard controls that matter most: privileged mode, host namespaces, hostPath mounts, root execution, and added capabilities.
  • Added the two operational policies that keep clusters stable: declared resource limits, and no mutable image tags.
  • Flagged default service account usage and automounted API tokens, which quietly grant workloads more cluster access than intended.

Verified evidence

Results and measurable impact

  • Flagged default service account usage and automounted API tokens, which quietly grant workloads more cluster access than intended.
  • Modelled audit mode alongside enforcement, showing exactly what a non-enforcing cluster is currently accepting.
  • Rendered a single admission decision from the policy set, since that is the artefact a developer sees when a deploy is rejected.
  • Paired each violation with the specific spec change that resolves it, rather than citing the standard.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

Kube Guard

Security platform

Kube GuardWorkspace6 updates
Kube Guard · Admission Controlkube-system/log-shipper-xk2 against the restricted standard
DENY 6

Cluster security is decided at admission, not at review time. Each pod spec is evaluated against the restricted Pod Security Standard plus two operational rules: declare resource limits, and never run a mutable image tag. Switch to audit mode to see what a cluster running without enforcement is actually accepting.

Decision

DENY

enforcing

Violations

6

deny-level policies

Warnings

4

allowed, logged

Service account

default

token automounted

Policy pass rate10 checks
10issues
Pod security context
PrivilegedtrueHost networktruehostPath/var/logRun as non-rootfalseRead-only rootfalseLimitsnone / none

Admission webhook rejects this spec: privileged, hostNetwork, hostPath, runAsNonRoot, capabilities, imagePin.

Policy evaluation
privilegedContainer requests privileged modedeny

Fix: Privileged is root on the node. Remove it and grant only the specific capability required.

hostNetworkShares the host network namespacedeny

Fix: Drop hostNetwork so the pod cannot see or bind node-level traffic.

hostPathMounts hostPath /var/logdeny

Fix: Replace with a PersistentVolumeClaim or a projected volume; hostPath is a node escape primitive.

runAsNonRootMay run as UID 0deny

Fix: Set runAsNonRoot true and a numeric runAsUser in the security context.

capabilitiesAdds capabilities: SYS_ADMINdeny

Fix: Drop ALL, then add back the minimum. SYS_ADMIN is equivalent to privileged for most purposes.

readOnlyRootFilesystemRoot filesystem is writablewarn

Fix: Set readOnlyRootFilesystem and mount an emptyDir for scratch space.

resourceLimitsMissing CPU and memory limitswarn

Fix: Declare both. A pod without a memory limit can evict its neighbours.

serviceAccountUses the default service accountwarn

Fix: Bind a dedicated service account with only the RBAC it needs.

automountTokenAutomounts the service account tokenwarn

Fix: Set automountServiceAccountToken false unless the workload calls the API server.

imagePinImage referenced by tag latestdeny

Fix: Pin by digest so a restart cannot pull different code.

Zain Khalil Khan