Kubernetes Security
Kubernetes security protects the cluster control plane, workloads, and data from unauthorized access and compromise. It covers RBAC, network policies, pod security standards, secrets management, image trust, runtime monitoring, and supply chain integrity.
itCloud native tools and technologies | OpenSkills.info
Recommended first:kubernetes-fundamentals
Intro
Kubernetes Security
Kubernetes security has a reputation for sprawl, and it's earned: identity, admission, workload hardening, secrets, network segmentation, and audit all live in different APIs. But the sprawl organizes cleanly once you see the structure — a request path to defend, a workload posture to harden, and layers around both. A cluster is not secure by default; it is securable, and the difference is a series of deliberate decisions this course maps.
The framing the ecosystem uses is the 4C's of cloud native security: Cloud, Cluster, Container, Code. Each layer builds on the one outside it — a hardened cluster on a compromised cloud account is not hardened, and perfect application code inside a privileged container is not protected. Kubernetes security work is mostly the middle two C's, with sharp boundaries to what must be handled elsewhere.
Defending the front door: API access
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://kubernetes.io/docs/concepts/security/
Supports
- Security mechanism taxonomy — control plane protection, secrets, workload protection, admission, auditing, policies
- TLS for control plane traffic; encryption at rest as separate opt-in
- Pod security standards and RuntimeClass for custom isolation
- https://kubernetes.io/docs/concepts/security/cloud-native-security/
Supports
- The 4C's layered model (Cloud, Cluster, Container, Code) and layer interdependence
- https://kubernetes.io/docs/concepts/security/controlling-access/
Supports
- Request pipeline — TLS, authentication, authorization, admission control
- No built-in human user database; certificate/token/OIDC authentication options
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/
Supports
- Role/ClusterRole and RoleBinding/ClusterRoleBinding semantics and scoping
- Additive-only permissions, deny-by-default
- Privilege escalation prevention (bind/escalate), least-privilege guidance
- https://kubernetes.io/docs/concepts/security/service-accounts/
Supports
- ServiceAccounts as Pod identity; projected short-lived tokens; opting out of token automounting
- https://kubernetes.io/docs/concepts/security/pod-security-standards/
Supports
- Privileged/Baseline/Restricted profile definitions and cumulative relationship
- https://kubernetes.io/docs/concepts/security/pod-security-admission/
Supports
- Built-in admission enforcement via namespace labels; enforce/audit/warn modes; staged rollout
- https://kubernetes.io/docs/concepts/security/pod-security-policy/
Supports
- PodSecurityPolicy removal in v1.25 and replacement by Pod Security Admission
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
Supports
- securityContext controls — runAsNonRoot, capabilities, allowPrivilegeEscalation, readOnlyRootFilesystem, seccomp
- https://kubernetes.io/docs/concepts/configuration/secret/
Supports
- Secrets as base64-encoded API objects, stored unencrypted in etcd by default
- Risk notes — anyone authorized to read/create Pods can access Secrets; mitigation guidance
- https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
Supports
- Encryption-at-rest configuration for Secrets (EncryptionConfiguration, KMS providers)
- https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
Supports
- Admission controllers intercepting API requests to validate or mutate
- https://kubernetes.io/docs/concepts/services-networking/network-policies/
Supports
- NetworkPolicy as the traffic segmentation mechanism; namespaces alone do not isolate traffic
- https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
Supports
- Audit logging of API requests — actors, actions, timing; audit policy stages
- https://kubernetes.io/docs/concepts/containers/runtime-class/
Supports
- RuntimeClass for selecting alternative/sandboxed container runtimes per workload