TechyPilots Info
TechyPilots.INFO
Home/Tutorials/Kubernetes/Security
Kubernetes Tutorial

Kubernetes Security

Learn how to secure Kubernetes clusters and workloads using RBAC, Service Accounts, Secrets, Network Policies, Pod Security Standards, Security Contexts, admission controls, and security best practices.

Level: Intermediate
Topics: Security & Hardening
Start LearningKubernetes Tutorials

Kubernetes Security

Protect Your Cluster and Workloads

RBAC & Access Control

Pod Security

Network Policies

Secrets Management

Security Monitoring

Introduction

Understanding Kubernetes security

Kubernetes security involves protecting the control plane, cluster infrastructure, applications, network communication, and sensitive data.

A secure Kubernetes environment typically uses multiple layers of protection instead of relying on a single security mechanism. Access controls, workload restrictions, network isolation, and secret management all work together.

Kubernetes provides built-in mechanisms such as RBAC, Secrets, Network Policies, Security Contexts, and Pod Security Standards that can be combined with infrastructure and operational security controls.

Security Fundamentals

Core Kubernetes security areas

Kubernetes security includes access control, workload hardening, network isolation, and protection of sensitive data.

01

Authentication & Authorization

Control who can access the Kubernetes API and what actions they are allowed to perform.

Key Topics

  • • Authentication
  • • RBAC
  • • Roles and ClusterRoles
  • • RoleBindings
02

Pod Security

Restrict workload privileges and apply security controls to Pods and containers.

Key Topics

  • • Pod Security Standards
  • • Security Contexts
  • • Non-root containers
  • • Privilege restrictions
03

Network Security

Control communication between workloads and restrict unnecessary ingress and egress traffic.

Key Topics

  • • Network Policies
  • • Ingress rules
  • • Egress rules
  • • Network isolation
04

Secrets Management

Protect sensitive configuration such as passwords, tokens, certificates, and API credentials.

Key Topics

  • • Kubernetes Secrets
  • • Least privilege
  • • Encryption at rest
  • • Service account tokens

Access Control

Role-Based Access Control

RBAC controls which identities can perform specific actions on Kubernetes resources. Permissions are defined using Roles or ClusterRoles and assigned through RoleBindings or ClusterRoleBindings.

The principle of least privilege is important when creating RBAC permissions. Users, applications, and Service Accounts should receive only the permissions required for their intended tasks.

RBAC Role Example

apiVersion: rbac.authorization.k8s.io/v1
kind: Role

metadata:
  name: pod-reader

rules:
  - apiGroups: [""]
    resources:
      - pods

    verbs:
      - get
      - list
      - watch

Permissions

Assigning permissions with RoleBindings

A Role defines permissions, while a RoleBinding assigns those permissions to users, groups, or Service Accounts.

Namespace-scoped Roles should be used when permissions do not need cluster-wide access.

RoleBinding Example

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding

metadata:
  name: read-pods

subjects:
  - kind: ServiceAccount
    name: app-service-account

roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Workload Identity

Securing Service Accounts

Kubernetes workloads can use Service Accounts to authenticate to the Kubernetes API.

If a workload does not need Kubernetes API access, avoid unnecessarily mounting a Service Account token. When access is required, grant only the specific permissions needed by the application.

Disable Automatic Token Mounting

apiVersion: v1
kind: Pod

metadata:
  name: example-app

spec:
  automountServiceAccountToken: false

  containers:
    - name: app
      image: nginx

Workload Protection

Pod Security Standards

Pod Security Standards define security profiles that can help restrict potentially dangerous workload configurations.

Kubernetes defines Privileged, Baseline, and Restricted security profiles. The appropriate policy depends on the workload and its operational requirements.

Pod Security Admission can apply these standards at the namespace level using enforce, audit, or warn modes.

Pod Security Labels

apiVersion: v1
kind: Namespace

metadata:
  name: production

  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Container Hardening

Security Contexts

A Security Context defines privilege and access-control settings for Pods and containers.

Security settings can control the user that runs the process, privilege escalation, Linux capabilities, filesystem access, and other workload-level security options.

Security Context Example

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

  capabilities:
    drop:
      - ALL

Network Security

Restrict traffic with Network Policies

Network Policies define how Pods are allowed to communicate with other workloads and network destinations.

Policies can control ingress traffic, egress traffic, or both. The networking implementation in the cluster must support NetworkPolicy enforcement.

A default-deny approach can help create an allow-list model where only explicitly permitted communication is allowed.

Default Deny Example

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy

metadata:
  name: default-deny

spec:
  podSelector: {}

  policyTypes:
    - Ingress
    - Egress

Sensitive Data

Kubernetes Secrets

Kubernetes Secrets are designed for confidential information such as passwords, API tokens, certificates, and SSH keys.

Secret data should be protected with appropriate access controls. Base64 encoding is not encryption, so encoded Secret manifests should still be treated as sensitive.

Encryption at rest can be configured to protect Secret data stored in the Kubernetes control plane.

Secret Example

apiVersion: v1
kind: Secret

metadata:
  name: database-secret

type: Opaque

stringData:
  username: appuser
  password: secure-password

Defense in Depth

Security should use multiple layers

A strong Kubernetes security posture combines multiple controls across the cluster instead of depending on a single mechanism.

API Security

Protect access to the Kubernetes API using authentication, authorization, TLS, and least-privilege access controls.

Workload Security

Restrict container privileges, apply Pod Security Standards, and configure Security Contexts.

Network Security

Control traffic between Pods and external systems using Network Policies and infrastructure controls.

Data Security

Protect sensitive data using Secrets, encryption at rest, restricted access, and careful secret handling.

Node Security

Protect worker nodes, kubelet access, operating systems, and isolate sensitive workloads where required.

Monitoring & Auditing

Use logging, monitoring, and audit mechanisms to detect unusual behavior and investigate security events.

kubectl

Useful security commands

These commands can help inspect access controls, identities, Secrets, Network Policies, and workload configuration.

kubectl get roles

List Roles in the current namespace.

kubectl get rolebindings

List RoleBindings in the current namespace.

kubectl auth can-i create pods

Check whether the current identity can perform an action.

kubectl get serviceaccounts

List ServiceAccounts in the current namespace.

kubectl get secrets

List Secret resources in the current namespace.

kubectl get networkpolicies

List NetworkPolicy resources.

kubectl get pods -o wide

Inspect Pods and the nodes where they are scheduled.

kubectl describe pod <pod-name>

Inspect Pod configuration and runtime information.

Learning Roadmap

How to learn Kubernetes security

Follow this progression to build a strong understanding of Kubernetes security concepts.

Step 1

Understand the Kubernetes Security Model

Learn the difference between control plane security, workload security, network security, and data protection.

Step 2

Learn RBAC

Understand Roles, ClusterRoles, RoleBindings, ClusterRoleBindings, and the principle of least privilege.

Step 3

Secure Service Accounts

Learn how workloads authenticate and avoid mounting service account credentials when they are unnecessary.

Step 4

Protect Sensitive Data

Use Kubernetes Secrets for confidential data and restrict access to sensitive resources.

Step 5

Apply Pod Security

Use Pod Security Standards and Security Contexts to reduce unnecessary container privileges.

Step 6

Restrict Network Traffic

Use Network Policies to define allowed ingress and egress communication between workloads.

Best Practices

Kubernetes security best practices

Use Least Privilege

Grant users, applications, and Service Accounts only the permissions required for their responsibilities.

Use Pod Security Controls

Apply appropriate Pod Security Standards and restrict unnecessary privileges.

Run Containers as Non-Root

Where application requirements allow, avoid running containers with unnecessary root privileges.

Restrict Network Traffic

Use Network Policies to limit communication between workloads and external destinations.

Protect Secrets

Restrict access to Secrets and avoid exposing sensitive values in source code or logs.

Review Access Regularly

Review RBAC permissions, Service Accounts, workload configuration, and cluster security settings periodically.

Continue Learning

Explore more Kubernetes tutorials

☸️

Kubernetes for Beginners

Learn Kubernetes architecture, clusters, nodes, Pods, Deployments, Services, and kubectl fundamentals.

🌐

Services and Networking

Learn Kubernetes Services, DNS, traffic routing, networking, and Network Policies.

📈

Scaling and Management

Learn manual scaling, HPA, VPA, node autoscaling, resource management, and Kubernetes operations.

Next Step

Start securing your Kubernetes workloads

Practice creating RBAC policies, configuring Security Contexts, applying Pod Security Standards, protecting Secrets, and restricting application traffic using Network Policies.

Explore Kubernetes TutorialsView All Tutorials