# Enforce Pod Security Standards by Configuring the Built-in Admission Controller

LLMS index: [llms.txt](/llms.txt)

---

Kubernetes provides a built-in [admission controller](/docs/reference/access-authn-authz/admission-controllers/#podsecurity)
to enforce the [Pod Security Standards](/docs/concepts/security/pod-security-standards).
You can configure this admission controller to set cluster-wide defaults and [exemptions](/docs/concepts/security/pod-security-admission/#exemptions).

## Before you begin

Following an alpha release in Kubernetes v1.22,
Pod Security Admission became available by default in Kubernetes v1.23, as
a beta. From version 1.25 onwards, Pod Security Admission is generally
available.


 <p>To check the version, enter  <code>kubectl version</code>.</p>


If you are not running Kubernetes 1.36, you can switch
to viewing this page in the documentation for the Kubernetes version that you
are running.

## Configure the Admission Controller


<div class="alert alert-info" role="note"><h4 class="alert-heading">Note:</h4><code>pod-security.admission.config.k8s.io/v1</code> configuration requires v1.25+.
For v1.23 and v1.24, use <a href="https://v1-24.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/">v1beta1</a>.
For v1.22, use <a href="https://v1-22.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/">v1alpha1</a>.</div>


```yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1 # see compatibility note
    kind: PodSecurityConfiguration
    # Defaults applied when a mode label is not set.
    #
    # Level label values must be one of:
    # - "privileged" (default)
    # - "baseline"
    # - "restricted"
    #
    # Version label values must be one of:
    # - "latest" (default) 
    # - specific version like "v1.36"
    defaults:
      enforce: "privileged"
      enforce-version: "latest"
      audit: "privileged"
      audit-version: "latest"
      warn: "privileged"
      warn-version: "latest"
    exemptions:
      # Array of authenticated usernames to exempt.
      usernames: []
      # Array of runtime class names to exempt.
      runtimeClasses: []
      # Array of namespaces to exempt.
      namespaces: []
```


<div class="alert alert-info" role="note"><h4 class="alert-heading">Note:</h4>The above manifest needs to be specified via the <code>--admission-control-config-file</code> to kube-apiserver.</div>