---
title: >-
  EKS clusters should run a Kubernetes version that supports Pod Security
  Admission to minimize the admission of privileged containers
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EKS clusters should run a Kubernetes
  version that supports Pod Security Admission to minimize the admission of
  privileged containers
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EKS clusters should run a Kubernetes version that supports Pod Security Admission to minimize the admission of privileged containers
 
## Description{% #description %}

Amazon EKS clusters should run a Kubernetes version that supports built-in Pod Security Admission so Pod Security Standards can be enforced to deny the admission of privileged containers. Privileged containers inherit all host capabilities and weaken container isolation, so workload namespaces should enforce at least the baseline (preferably restricted) profile. The available schema does not expose per-namespace Pod Security Admission labels, so this rule verifies the cluster runs Kubernetes 1.25 or later, where PSA is enabled by default and the legacy PodSecurityPolicy controller has been removed.

## Remediation{% #remediation %}

Upgrade the cluster to a supported Kubernetes version using the [Updating an Amazon EKS cluster Kubernetes version](https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.html) guide, then label each workload namespace to enforce Pod Security Standards (for example, `kubectl label ns NAMESPACE pod-security.kubernetes.io/enforce=restricted --overwrite`) and update workload manifests so no container, init container, or ephemeral container sets `securityContext.privileged: true`.

## References{% #references %}

- [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
- [CIS Amazon EKS Benchmark](https://www.cisecurity.org/benchmark/kubernetes)