Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

/triage accepted

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

/remove-lifecycle stale

Hello @tssurya @liggitt
This PR has not been updated for 4 months, so I'd like to check what's the status. If there's anything we can do, please let us know. The code freeze is starting 02:00 UTC Friday 25th July 2025 (about 4 weeks from now). Please make sure the PR has both lgtm and approved labels before the code freeze.
Thanks!

a couple nits, then lgtm

please also open the documentation PR to update https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline for the dev-1.34 branch in https://github.com/kubernetes/website/

thank you @liggitt for taking the time and patiently reviewing this and for your valuable suggestions, I'll fix the last set of comments now..
I have opened a draft docs PR here: kubernetes/website#51498 will update the docs

/lgtm
/approve

LGTM label has been added.

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

It seems like this PR may have broken https://testgrid.k8s.io/sig-api-machinery-emulated-version

@tssurya it seems to be breaking poststart hooks, is this also occurring in regular conformance tests?

@michaelasp : Looking at the test grid link I can see its the same two sig-node tests around Lifecycle Hooks - if the tests are using '.Host' in the life cycle hook then yes I might have broken them :( starting this PR
I did fix these two failing tests in regular conformance to run in privileged mode..(See last commit in this PR: 4c87e60) Should I have also done that for n-1 somehow ? LMK if I missed a spot somehow..I am new to the test grid so not exactly sure what the version compatbility test matrix does - but if its doing what I think its doing which is running my PSA code in older n-1 versions then yes we will fail with:

https://prow.k8s.io/view/gs/kubernetes-ci-logs/logs/ci-kubernetes-e2e-kind-compatibility-versions-n-minus-1/1948226823225610240
	3s
{ failed [FAILED] Error creating Pod: pods "pod-with-prestop-http-hook" is forbidden: violates PodSecurity "baseline:latest": probe or lifecycle host (container "pod-with-prestop-http-hook" uses probe or lifecycle host "10.244.1.78")

We added a PSA blocking all .Host fields from being set in baseline mode. I'm not sure how in the past these cases have been handled... If I knew where to look for version compatibility tests I can fix them there too - Is it about having two versions of the tests or something and keeping a Min version to run these?

Also, those two sig-node tests also need a cleanup (#133091).

It seems like this might be the first new PSA rule added since KEP-4330: Compatibility Versions in Kubernetes?

I think the answer here is that PSA application needs to be based on the --emulated-version rather than the actual apiserver version. @liggitt @jpbetz?

hrmm... yeah... emulating an older minor should really adjust what PSA sees as the "latest" minor for the checks it chooses to run. I started plumbing emulated version into admission and it got really big really fast. I opened #133176 as a stop-gap for this one feature, will follow up in 1.35 to make admission and PSA generally emulation-version-aware.

(following up, https://testgrid.k8s.io/sig-testing-kind#compatibility-version-test-n-minus-1 jobs are green again after merge of #133176)

This one is still failing since 2025-07-24:

• ci-kubernetes-e2e-kind-rootless failing since 2025-07-24 ([It] [sig-node] Container Lifecycle Hook when create a pod with lifecycle hook should execute ...) #133330

• [FAILED] [6.590 seconds]
[sig-node] Container Lifecycle Hook when create a pod with lifecycle hook [It] should execute poststart https hook properly [MinimumKubeletVersion:1.23] [NodeConformance] [sig-node, NodeConformance]
k8s.io/kubernetes/test/e2e/common/node/lifecycle_hook.go:194
   Timeline >>
  STEP: Creating a kubernetes client @ 07/24/25 07:49:56.477
  I0724 07:49:56.477650 2815 util.go:453] >>> kubeConfig: /home/prow/go/src/k8s.io/kubernetes/_rundir/188a9770-7f1e-4d01-8648-e5dce8a2ca03/kubeconfig
  STEP: Building a namespace api object, basename container-lifecycle-hook @ 07/24/25 07:49:56.478
  STEP: Waiting for a default service account to be provisioned in namespace @ 07/24/25 07:49:56.561
  STEP: Waiting for kube-root-ca.crt to be provisioned in namespace @ 07/24/25 07:49:56.569
  STEP: create the container to handle the HTTPGet hook request. @ 07/24/25 07:49:56.59
  STEP: create the pod with lifecycle hook @ 07/24/25 07:50:02.706
  I0724 07:50:02.712557 2815 lifecycle_hook.go:101] Unexpected error: Error creating Pod: 
      <*errors.StatusError | 0xc00063c000>: 
      pods "pod-with-poststart-https-hook" is forbidden: violates PodSecurity "baseline:latest": probe or lifecycle host (container "pod-with-poststart-https-hook" uses probe or lifecycle host "10.244.0.7")
      {
          ErrStatus: 
              code: 403
              details:
                kind: pods
                name: pod-with-poststart-https-hook
              message: 'pods "pod-with-poststart-https-hook" is forbidden: violates PodSecurity
                "baseline:latest": probe or lifecycle host (container "pod-with-poststart-https-hook"
                uses probe or lifecycle host "10.244.0.7")'
              metadata: {}
              reason: Forbidden
              status: Failure,
      }