In Azure Kubernetes Service (AKS), you can apply PSS alongside Deployment Safeguards (which handles operational best practices like resource sizing and topology spread).

Deployment Safeguards enforce Kubernetes best practices via Azure Policy. Two levels:

• Warn: shows warnings but allows the deployment through
• Enforce: denies/mutates non-compliant deployments (also auto-sets resource requests, anti-affinity rules, etc.)

AKS Automatic clusters get Enforce by default. AKS Standard clusters opt in manually.

Prerequisites

• Azure Policy add-on enabled on your cluster
• Microsoft.PolicyInsights resource provider registered in your subscription
• aks-preview CLI extension installed

---

Step 1: Install/Update the AKS Preview Extension

az extension add --name aks-preview
# or update if already installed
az extension update --name aks-preview

Step 2: Register the Feature Flag

az feature register --namespace Microsoft.ContainerService --name SafeguardsPreview

Check status (wait until it shows Registered):

az feature show --namespace Microsoft.ContainerService --name SafeguardsPreview

Then refresh the provider:

az provider register --namespace Microsoft.ContainerService

Step 3: Enable Deployment Safeguards

New cluster (Warning mode):

az aks create \
  --name myCluster \
  --resource-group myRG \
  --enable-addons azure-policy \
  --safeguards-level Warning

Existing cluster (upgrade to Enforcement):

az aks update \
  --name myCluster \
  --resource-group myRG \
  --safeguards-level Enforcement

Step 4: Exclude Namespaces (Optional)

If certain namespaces (e.g. dev sandboxes) shouldn’t be gated:

az aks update \
  --name myCluster \
  --resource-group myRG \
  --safeguards-level Warning \
  --safeguards-excluded-ns ns1,ns2

Step 5: Verify Compliance

Give it ~35 minutes for Azure Policy to sync on first enable. Then test:

kubectl apply -f my-deployment.yaml

Non-compliant resources will show warnings (in Warn mode) or get rejected (in Enforce mode). You can also check the Azure Policy compliance dashboard in the portal for an aggregate view.

Step 6: Disable (If Needed)

az aks update \
  --name myCluster \
  --resource-group myRG \
  --safeguards-level Off

Key policies that activate:

1. Resource requests/limits must be defined (mutator sets defaults of 500m CPU / 2Gi memory if missing)
2. Anti-affinity / topology spread constraints must exist for multi-replica workloads
3. No latest image tag, use explicit versions
4. Liveness & readiness probes required
5. CSI driver StorageClass only (no in-tree provisioners)
6. Unique service selectors
7. No editing individual nodes (use node pools via CLI)
8. No AKS-reserved labels on your workloads
9. System pool taints stay reserved

you’ll want to cross-reference the AKS baseline reference architecture and the AKS deployment safeguards accelerator

---

• 
• 
• 
•