kubernetes-security-policies

Pod Security Standards enforce baseline or restricted policies at the namespace level through Pod Security Admission controllers. Apply PSA labels to namespaces to automatically validate and audit pod configurations against security baselines, blocking or warning on non-compliant deployments without manual policy files.

RBAC controls who can perform actions on resources through least-privilege role bindings, while network policies restrict traffic flow between pods and external endpoints. Both are essential: RBAC gates API access; network policies isolate workload communication paths.

OPA/Gatekeeper acts as an admission controller that intercepts API requests and evaluates them against custom policy rules before objects are created. Deploy Gatekeeper as a webhook, write Rego policies to define constraints, and bind them to resources to enforce organization-wide security rules dynamically.

Security auditing maps cluster configurations and runtime behavior to compliance frameworks like CIS, NIST, and PCI-DSS benchmarks. Review RBAC roles, network policies, secrets encryption, image scanning, and security contexts against published hardening guides to identify and remediate gaps.

Runtime security detects and responds to threats during pod execution through Security Contexts that restrict capabilities, AppArmor/SELinux profiles that limit system calls, and admission policies that block privileged or unsafe configurations before they run.

Admission controllers enforce secrets management policies by validating encryption at rest, restricting secret access via RBAC, and blocking plaintext credentials in environment variables or logs. Combined with network policies and Security Contexts, they create a layered secrets protection strategy.