Cloud Security
Kubernetes Security
Hardening clusters, workloads and access in Kubernetes.
- 6 notes
- 50 minutes of reading
- Kubernetes architecture: control plane, nodes, pods and servicesA plain-language tour of Kubernetes components, from the API server and etcd to nodes, pods, deployments and services, showing where each security control fits. 8 min · Beginner
- Kubernetes RBAC: roles, cluster roles, bindings and service accountsHow Kubernetes role-based access control works, the difference between Roles and ClusterRoles and their bindings, how service accounts fit in, and how to apply least privilege. 9 min · Intermediate
- Kubernetes network policies: default deny and allowing only needed trafficHow Kubernetes NetworkPolicy objects segment pod traffic, why you start with default deny for ingress and egress, and how to allow only the flows each application needs, including DNS. 8 min · Intermediate
- Pod Security Standards and admission control: privileged, baseline and restrictedHow Kubernetes Pod Security Standards define privileged, baseline and restricted profiles, how Pod Security admission enforces them per namespace, and where policy engines add further checks. 8 min · Intermediate
- Kubernetes Secrets and etcd encryption: risks and better optionsWhy Kubernetes Secrets are only base64-encoded by default, how to turn on encryption at rest with a KMS provider, how to lock down etcd and its backups, and when to use an external secret store instead. 8 min · Advanced
- Hardening a Kubernetes cluster: API access, upgrades, auditing and CIS ideasA practical plan for hardening a Kubernetes cluster: restricting API server access, securing nodes and the kubelet, staying on supported versions, enabling audit logging and checking against the CIS Kubernetes Benchmark. 9 min · Advanced