[CNCF LFX Proposal] Kyverno: Update Pod Security Standards for User Namespaces

### CNCF Project

Kyverno

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Update Pod Security Standards for User Namespaces

### Program Description

## Description

Kubernetes user namespaces is now GA!

https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
https://kubernetes.io/blog/2025/04/25/userns-enabled-by-default/

This impacts pod security standards and the Kyverno policy set that supports these.

## Expected outcomes

We need to be update the pod security libraries to add user namespaces:

https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/#integration-with-pod-security-admission-checks

### Technologies

Go, Kubernenets, Containers, Security

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

### Mentors

Shuting Zhao | @realshuting | shuting@nirmata.com | ShutingZhao
Ammar Yasser | @aerosouund | ammar.yasser@nirmata.com | AmmarYasser

### Upstream Issue URL

https://github.com/kyverno/kyverno/issues/15979

### Application Prerequisites

- [x] Resume
- [x] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [x] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

Solution Video

### Custom Prerequisite Description

Create a 2-5 minute video introducing yourself and then articulating your understanding of the problem and the proposed solution. Provide a link to the video on either Google Drive or YouTube as part of your cover letter.

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - Kyverno: Update Pod Security Standards for User Namespaces (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/898098d8-ce58-409a-834e-32306fc2f46e)

Start by reading the upstream Kyverno issue and the Kubernetes user namespaces documentation, especially the integration with Pod Security Admission checks. Locate the pod security libraries and policy set referenced by the upstream work, then update them to account for user namespaces and verify that the related security checks and policies behave as expected.

Written by the indexing model from the issue text.