Leveling up Kubernetes Posture: From baselines to risk-aware admission

This report explains why Kubernetes Pod Security Standards/Admission are effective but coarse, and argues for a risk-aware admission model that evaluates workload context (identity, labels, ownership), vulnerability posture, and environment at deployment time. It demonstrates how Sysdig can apply multiple control sets (e.g., CIS, OWASP), scope enforcement beyond namespaces using labels/Helm metadata, and manage granular exceptions without degrading overall posture. The report emphasizes complementing admission decisions with runtime detection to cover behavioral risks after workloads start, delivering a more precise and scalable security posture for modern Kubernetes environments.