The Day the Security Music Stopped
February 2026 arrived with Kubernetes 1.32, and with it came the long-promised deprecation of PodSecurityPolicy. If you’re reading this while frantically googling migration strategies, you’re not alone. The CNCF Kubernetes Adoption Survey 2026 shows that 78% of existing security configurations broke when organizations attempted the upgrade. That’s not a typo. Three-quarters of production clusters suddenly found themselves with non-functional security policies.
This isn’t just another deprecation notice you can ignore for a few release cycles. Pod Security Standards have been the writing on the wall since 1.21, but the actual migration reality turns out way messier than the documentation suggested. I’ve spent the last six months helping teams navigate this transition, and honestly? The patterns I’m seeing tell a story the official guides don’t capture.
The fundamental problem isn’t technical complexity. It’s that PodSecurityPolicy and Pod Security Standards work on completely different ideas about how security should work. PSP was granular, namespace-agnostic, and worked through RBAC bindings. Pod Security Standards are namespace-scoped, profile-based, and assume a simpler mental model that just doesn’t map cleanly to what enterprises actually need.
Enterprise Migration: Where Automation Fails
Red Hat learned this the hard way with OpenShift 4.17. Their platform ships with 156 default security policies that needed manual migration. The automated conversion tools they provided? Only a 34% success rate in complex enterprise environments. When Red Hat’s own tooling struggles with their own policies, that should tell you something.
The core issue is context loss. PodSecurityPolicy let you create rules that considered cluster topology, user roles, and workload characteristics all at once. Pod Security Standards force you to pick between three rigid profiles: privileged, baseline, and restricted. Real-world security requirements rarely fit into these neat little boxes.
I’ve watched teams spend weeks trying to map legacy PSP rules to the new standards, only to discover they need to completely rethink their security model. The namespace-scoping requirement alone breaks many existing patterns where security policies were applied cluster-wide with specific exceptions.
The Hidden Costs of “Simplified” Security
Google’s approach with GKE Autopilot shows both the promise and the price of this transition. Their automatic PSP migration handles the technical conversion smoothly, but it comes with an 18% average increase in cluster costs due to enhanced security scanning overhead. That’s the real cost of Pod Security Standards: they push complexity from configuration into runtime enforcement.
The Cloud Native Security Alliance Report found that 23% of Fortune 500 companies delayed their Kubernetes upgrades beyond planned timelines specifically because of PSP migration challenges. These aren’t small shops struggling with documentation. These are organizations with dedicated platform teams who still couldn’t make the transition work within their existing constraints.
Rancher’s migration experience gives us the most realistic picture of what most organizations face. Their tooling successfully converted 67% of legacy PSP configurations automatically, but multi-tenant clusters required manual intervention across 890 production environments. Multi-tenancy is where the namespace-scoped nature of Pod Security Standards really shows its limitations.
What This Really Means for Your Operations
The shift from PodSecurityPolicy to Pod Security Standards represents more than a feature migration. It’s a fundamental change in how Kubernetes thinks about security boundaries. The old model treated security as a cluster-wide concern with fine-grained controls. The new model treats security as a namespace concern with coarse-grained profiles.
This works well for greenfield deployments and simple multi-tenancy scenarios. It breaks down when you have complex security requirements that span namespace boundaries or need granular controls that don’t fit the three standard profiles. The number of organizations discovering this gap makes me think the Kubernetes project may have oversimplified the problem space.
For teams still planning their migration, here’s the key insight: you’re not just replacing one API with another. You’re potentially redesigning your entire security model. Budget time accordingly. The organizations that approached this as a simple technical migration? They struggled. The ones that treated it as a security architecture review generally did much better.
The Path Forward
Pod Security Standards are here to stay, and PodSecurityPolicy is going away whether we like it or not. The question isn’t whether to migrate, but how to do it without breaking production systems or compromising security.
Start with audit mode. Pod Security Standards support warning and audit modes that let you observe violations without enforcement. Use this to understand what your current workloads actually do, not what you think they do. Many teams discovered they had overprivileged workloads that PSP was silently allowing.
Accept that you might need additional tooling. Pod Security Standards provide a minimal set of controls on purpose. If you need more granular security policies, plan to implement them through admission controllers, OPA Gatekeeper, or other policy engines. The Kubernetes project expects this to be a layered approach, not a single solution.
If you’ve been through this migration, I’m curious about your experience. What patterns worked? Where did the standard approaches fail? The community needs more real-world data about what this transition looks like in practice, beyond the success stories in vendor blog posts.