As Kubernetes adoption continues to grow across enterprise environments, platform teams are increasingly responsible for more than just delivering clusters. They are expected to provide secure, standardized platforms that enable application teams to deploy quickly while meeting organizational security and compliance requirements.

Kubernetes admission policies have become an important part of that strategy. This means validating workloads before they are admitted to the cluster, so that organizations can prevent common security misconfigurations such as privileged containers, host namespace access, or containers running as the root user.

The challenge isn’t understanding the value of policy enforcement—it’s managing it at scale.

Organizations want to build a comprehensive policy library, but this requires time, expertise, and ongoing maintenance. They must identify which policies to implement, author or source policy definitions, validate them, and distribute them consistently across clusters.

With this release, VMware vSphere Kubernetes Service (VKS) introduces the Policy Bundle add-on, providing a curated set of Kubernetes admission policies aligned with the NSA/CISA Kubernetes Hardening Guidance v1.2. With the combination of the Broadcom-curated Gatekeeper add-on, platform engineers can quickly establish a supported security baseline without the operational burden of creating and maintaining policy definitions themselves.

A Curated Security Baseline

The Policy Bundle delivers a comprehensive collection of pre-packaged admission policies based on the NSA/CISA Kubernetes Hardening Guidance v1.2. Instead of writing and maintaining individual Gatekeeper constraint templates and constraints, platform engineers can install a curated policy profile as part of their cluster lifecycle.

Because the policies are packaged and delivered through VKS, organizations can deploy a consistent security baseline across clusters while reducing the operational effort required to manage policy content. Rather than sourcing, packaging, and maintaining policy definitions themselves, platform teams can rely on a Broadcom-curated policy set that is integrated with VKS and ready to deploy.

Adopt Policies at Your Own Pace

Every Kubernetes environment is different. Some organizations are deploying new greenfield clusters, while others are modernizing long-running production environments. Recognizing this, the Policy Bundle gives platform engineers flexibility over how policies are introduced.

Select the Policies That Matter

Not every organization needs every recommendation. Platform engineers can choose which policies from the NSA/CISA profile should be enabled on each cluster, such as restricting containers from running as the root user, preventing host path mounts, or blocking privileged containers. This allows them to tailor enforcement to their environment while still leveraging a recognized security baseline.

Roll Out Enforcement Gradually

Moving directly to blocking workloads can be disruptive, particularly for existing production clusters. Each policy can be configured independently in either:

• Warn mode: Violations are identified, but workloads continue to deploy safely.
• Deny mode: Non-compliant workloads are rejected during admission.

This phased approach allows platform teams to identify violations, work with application owners to remediate issues, and confidently transition to enforcement once workloads are compliant.

Handle Legitimate Exceptions

Some trusted platform components legitimately require elevated permissions to perform their function. Examples include infrastructure agents, networking components, storage drivers, and monitoring software.

To support these use cases without compromising cluster security, the Policy Bundle provides flexible exclusion scoping across global, profile, and constraint levels. This helps ensure infrastructure services run unhindered while keeping application workloads strictly protected:

• Exempted Workload Example: A monitoring agent (DaemonSet) or storage driver that requires access to host namespaces and path mounts to capture node telemetry.
• Enforced Workload Example: A frontend web API or microservice that should strictly run as an unprivileged, non-root container.

Built on Gatekeeper

The Policy Bundle works alongside the Broadcom-curated Gatekeeper add-on, which serves as the underlying admission control engine evaluating Kubernetes API requests. While Gatekeeper handles the technical evaluation, the Policy Bundle supplies the curated policy definitions aligned with NSA/CISA guidance by providing an integrated enforcement solution without requiring platform engineers to author or maintain policy content.

Prerequisite: The Broadcom-curated Gatekeeper add-on must be installed and healthy on the target VKS cluster prior to enabling the Policy Bundle.

Designed for Enterprise Platform Teams

Deployment Scenario	Value and Recommended Strategy
Greenfield Clusters	Establish a security baseline from day one by enabling policy enforcement (Deny mode) as part of your provisioning workflows.
Existing Production Clusters	Begin in Warn mode to understand your current compliance posture before gradually enabling Deny mode as applications are remediated.
Regulated Industries	Align Kubernetes deployments with published security guidance while maintaining flexibility to accommodate trusted platform services that require elevated privileges.

Looking Ahead

The Policy Bundle represents another step toward simplifying secure Kubernetes operations on VKS. Rather than asking platform teams to assemble and maintain their own policy libraries, VKS delivers a supported, curated security baseline that helps organizations adopt Kubernetes hardening best practices more quickly and consistently.

By combining curated NSA/CISA-aligned policies with the Broadcom-curated Gatekeeper add-on, VKS enables platform teams to establish a consistent security baseline while retaining the flexibility to tailor policy enforcement to the needs of their environments.

Learn More and Get Started

The VKS Policy Bundle is available as a VKS add-on and requires the Broadcom-curated Gatekeeper add-on to be installed on the target cluster. To learn more about configuring the Policy Bundle, supported policies, and deployment guidance, refer to the VKS documentation.