#Pod Security Admission

The Pod Security Admission (PSA) profile that a namespace enforces determines whether the pods of your mesh workloads are admitted.

• Baseline: All mesh workloads are admitted with the default control plane configuration.
• Restricted: A mesh workload is admitted only when its pod carries the RuntimeDefault seccomp profile, which the control plane does not add by default. Otherwise the pod is rejected, for example with seccompProfile ... must be set to "RuntimeDefault" or "Localhost".

Each kind of workload is configured separately:

#Injected sidecars

Injected sidecars are admitted into a Restricted namespace only when both of the following conditions are met:

• The IstioCNI resource is deployed, so that the control plane injects the unprivileged istio-validation container instead of the privileged istio-init container. This is the default installation flow described in Installing Alauda Service Mesh.

• The Istio resource sets spec.values.global.proxy.seccompProfile.type to RuntimeDefault:

  apiVersion: sailoperator.io/v1
  kind: Istio
  metadata:
    name: default
  spec:
    values:
      global:
        proxy:
          seccompProfile:
            type: RuntimeDefault

  This setting applies to the istio-validation and istio-proxy containers only.

#Gateway API gateways and waypoint proxies

The control plane renders gateways deployed with the Kubernetes Gateway API and waypoint proxies from its own templates, which do not read spec.values.global.proxy.seccompProfile. The Istio resource does not expose spec.values.gateways either; that field is silently discarded. Configure the seccomp profile with the spec.values.gatewayClasses overlay, which the control plane merges into the generated Deployment.

Patch the Istio resource before you create a Gateway resource in a namespace that enforces the Restricted profile. Apply only the gateway classes that you use.

• For gateways that use the istio gateway class:

  kubectl patch istio default --type=merge -p '{"spec":{"values":{"gatewayClasses":{"istio":{"deployment":{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}}}}}}'

• For waypoint proxies, which use the istio-waypoint gateway class:

  kubectl patch istio default --type=merge -p '{"spec":{"values":{"gatewayClasses":{"istio-waypoint":{"deployment":{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}}}}}}'

The patch merges by key, so you can apply both commands and keep both overlays.

Verification

Confirm that the control plane generated a ConfigMap for each patched gateway class by running the following command:

kubectl get configmap -n istio-system -l gateway.istio.io/defaults-for-class

Example output

NAME                                        DATA   AGE
istio-default-gatewayclass-istio            1      10s
istio-default-gatewayclass-istio-waypoint   1      10s

#Reference

• Pod Security Standards (Kubernetes documentation)
• Restrict a Container's Syscalls with seccomp (Kubernetes documentation)