DevSecOps Practice Hub

Kubernetes Security

Secure clusters, workloads, RBAC, network policy, images and runtime behaviour across Kubernetes and OpenShift.

AdvancedKubernetes SecurityContainerInfrastructureIdentity

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

Kubernetes security spans control-plane configuration, workload hardening, least-privilege RBAC, network segmentation, admission control and runtime detection. Each layer is independently configurable, which is why defence in depth matters here.

Why it matters

Default Kubernetes settings favour flexibility over restriction. Without deliberate hardening, a single compromised pod can often reach the API server, other namespaces and cloud credentials.

How it works

  1. 01Pod Security Admission or an equivalent policy engine restricts workload capabilities.
  2. 02RBAC is scoped per service account and audited for wildcard verbs.
  3. 03NetworkPolicies establish default-deny east-west traffic.
  4. 04Runtime sensors detect unexpected process, file and network behaviour.

Common tools

FalcoKyvernoTrivyOpen Policy AgentKubernetesOpenShiftDockerPodman

Implementation examples

yamlHardened pod security context
securityContext:  runAsNonRoot: true  runAsUser: 10001  allowPrivilegeEscalation: false  readOnlyRootFilesystem: true  seccompProfile:    type: RuntimeDefault  capabilities:    drop: ["ALL"]
Covers the majority of Pod Security 'restricted' requirements. Verify the application can run with a read-only root filesystem before enforcing.
yamlDefault-deny NetworkPolicy
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: default-deny-ingress  namespace: paymentsspec:  podSelector: {}  policyTypes: [Ingress]
Requires a CNI that implements NetworkPolicy. Add explicit allow rules before applying in a live namespace.

Security considerations

  • Audit RBAC for cluster-admin bindings and wildcard resources.
  • Restrict service-account token automounting where it is not needed.

Best practices

  • Enforce the restricted Pod Security standard for application namespaces.
  • Default-deny network traffic and allow explicitly.
  • Keep node and control-plane versions on a supported release cadence.

Common mistakes

  • Granting cluster-wide roles for convenience.
  • Relying on image scanning alone with no runtime detection.

Hands-on labs