kubernetes-security

RBAC (Role-Based Access Control) in Kubernetes uses Roles, RoleBindings, and service accounts to define permissions. Create a Role with specific API verbs and resources, bind it to a service account via RoleBinding, and assign that account to pods to enforce least-privilege access across your cluster.

Pod security hardening enforces runAsNonRoot to prevent root execution, sets readOnlyRootFilesystem to block writes, and drops unsafe Linux capabilities. These controls combined with Pod Security Standards restrict the attack surface and prevent privilege escalation in containerized workloads.

Network policies define ingress and egress rules for pod communication by matching labels and specifying allowed sources or destinations. Apply them to restrict lateral movement, isolate workloads, and enforce zero-trust network segmentation within your cluster.

Kubernetes security requires encrypted or externally managed secrets instead of hardcoded values in manifests. Enable encryption at rest, use external secret managers, and avoid storing sensitive data in pod definitions to meet compliance and prevent credential exposure.

Enforce image security by requiring explicit tags (no latest), setting imagePullPolicy to Always, running security scans on images, and validating they run as non-root with dropped capabilities and read-only filesystems before deployment.

Set resource limits and quotas on CPU, memory, and storage to prevent pod sprawl and denial-of-service attacks. Combined with Pod Security Standards, these controls enforce fair resource allocation and stop misconfigured or malicious workloads from consuming cluster capacity.