The Reckoning Nobody Wanted to Face
When Kubernetes 1.32 landed in February 2026, it carried with it a deprecation notice that had been telegraphed for years but still managed to catch most organizations flat-footed. The retirement of PodSecurityPolicy in favor of Pod Security Standards wasn’t just another API version bump. According to the CNCF Kubernetes Adoption Survey 2026, it broke 78% of existing security configurations across surveyed clusters.
This wasn’t a surprise to anyone who had been paying attention. PSP had been marked for deprecation since Kubernetes 1.21, with warnings scattered across release notes like breadcrumbs leading to this cliff. Yet here we are, watching enterprise after enterprise scramble to rebuild security policies that have been running production workloads for years. The question isn’t whether this transition was necessary, but whether the ecosystem was actually ready for what it demanded.
The numbers tell a story of widespread unpreparedness. When three-quarters of your security configurations become invalid overnight, that’s not just a migration challenge. That’s a fundamental disconnect between the theoretical elegance of deprecation cycles and the messy reality of production systems that can’t simply be rewritten on a timeline that suits upstream developers.
Enterprise Reality Meets Kubernetes Idealism
Red Hat’s OpenShift 4.17 provides perhaps the clearest window into what this transition actually means for enterprise users. The platform ships with 156 default security policies that require manual migration. Not partial migration or assisted migration, but manual intervention by engineers who need to understand both the legacy PSP model and the new Pod Security Standards framework well enough to translate between them.
The automated migration tools that were supposed to smooth this transition have proven less reliable than promised. In complex enterprise environments, these tools achieve only a 34% success rate. That leaves 66% of configurations requiring human intervention, debugging, and often complete rewrites. For organizations running hundreds or thousands of workloads, this represents months of engineering effort that wasn’t budgeted and can’t be easily parallelized.
The automation failure isn’t entirely surprising to those of us who have watched migration tools promise the world before. Security policies aren’t just configuration files that can be mechanically translated. They represent institutional knowledge about threat models, compliance requirements, and operational constraints that have been refined over years of production experience. Expecting an automated tool to capture and preserve that nuance was always optimistic at best.
The Fortune 500 Revolt
Perhaps the most damning indictment of this transition comes from the Cloud Native Security Alliance Report, which found that 23% of Fortune 500 companies delayed their Kubernetes upgrades beyond planned timelines specifically because of PSP deprecation. These aren’t small startups that can afford to move fast and break things. These are organizations with regulatory obligations, audit requirements, and risk management frameworks that don’t accommodate “figure it out as we go” approaches to security policy migration.
The delay pattern reveals something important about how enterprise adoption actually works versus how the Kubernetes community assumes it works. Large organizations don’t upgrade because new features are available. They upgrade when the risk of staying on older versions exceeds the risk of moving to newer ones. When a major security subsystem requires complete replacement, that calculation shifts dramatically.
What makes this particularly frustrating is that Pod Security Standards aren’t inherently better than PSP for many use cases. They’re different, and in some ways simpler, but the migration pain isn’t buying meaningful security improvements for most organizations. It’s change for the sake of architectural purity, imposed on users who were perfectly happy with the existing system.
Tool Ecosystem Struggles to Keep Pace
Rancher’s experience with their migration tooling illustrates both the promise and limitations of vendor-provided solutions. Their tool successfully converted 67% of legacy PSP configurations, which sounds reasonable until you realize that failure rate jumps significantly in multi-tenant environments. The tool affected 890 production environments that required manual intervention, often during maintenance windows that had to be extended or repeated.
Multi-tenant clusters present particular challenges because PSP and Pod Security Standards handle tenant isolation differently. PSP operated at the cluster level with fine-grained RBAC integration, while Pod Security Standards work at the namespace level with less flexibility for complex tenant hierarchies. Organizations that built sophisticated multi-tenant architectures around PSP find themselves rearchitecting fundamental assumptions about how security boundaries work.
Google’s approach with GKE Autopilot represents the other end of the spectrum. Rather than providing migration tools, they simply handle the transition automatically within their managed service. This works, technically, but comes with an 18% increase in cluster costs due to enhanced security scanning overhead. When you can’t opt out of the migration, you also can’t opt out of the additional operational complexity and cost that comes with it.
The Path Forward Through the Wreckage
The PSP deprecation represents something larger than a single API change. It’s a case study in how the Kubernetes community handles breaking changes at scale, and the results aren’t encouraging. The assumption that organizations can simply adapt to upstream decisions on upstream timelines has proven false for a significant portion of the enterprise user base.
For organizations still dealing with this migration, the path forward requires accepting that automated tools will handle the simple cases and everything else needs human expertise. Budget for significant engineering time, plan for multiple iterations of policy refinement, and don’t assume that your new Pod Security Standards configuration will provide the same operational characteristics as your old PSP setup.
The broader lesson here extends beyond security policies to any major Kubernetes subsystem. The community’s approach to deprecation assumes a level of organizational agility and engineering capacity that simply doesn’t exist for many users. Until that disconnect is acknowledged and addressed, we’ll continue seeing migrations that work beautifully in demo environments and create chaos in production.
If you’ve been through this migration yourself, I’d be curious to hear how it went for your organization. The official success stories don’t always match what I’m hearing from engineers in the field, and understanding the real-world impact helps inform better approaches to future transitions.