Kubernetes Security Best Practices:

 

Kubernetes Security Best Practices: A Comprehensive Guide

📅 Published: September 2026
⏱️ Estimated Reading Time: 18 minutes
🏷️ Tags: Kubernetes Security, Cluster Security, Pod Security, RBAC, Network Policies

---

Introduction: The Shared Responsibility Model

Kubernetes security is a shared responsibility. The cloud provider secures the infrastructure (hardware, network, hypervisor), while you are responsible for securing the cluster itself, the workloads running on it, and the data it stores.

Think of Kubernetes security as layers of an onion. No single security control is sufficient. You need defense in depth—multiple layers of protection that work together to keep your cluster safe.

This guide covers the essential security controls for every Kubernetes cluster:

• Authentication & Authorization: Who can access the cluster and what they can do

• Pod Security: How pods run and what they can access

• Network Security: What traffic is allowed

• Image Security: Ensuring containers are safe

• Cluster Security: Securing the control plane and nodes

---

Part 1: Authentication and Authorization

1. Use RBAC (Role-Based Access Control)

RBAC is the primary mechanism for controlling access to the Kubernetes API.

Best Practices:

• Enable RBAC: Ensure RBAC is enabled (default on most clusters)

• Least Privilege: Grant only the permissions needed

• Use Groups: Assign permissions to groups, not individual users

• Regular Audits: Review RBAC configurations periodically

Example RBAC:

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: developer@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Common RBAC Roles:

Role	Permissions	Use Case
Viewer	Read-only access to all resources	Auditors, monitoring
Developer	Create/update pods, services, configmaps	Application developers
Operator	Full access to a specific namespace	Team leads
Admin	Full access to all namespaces	Cluster administrators
Cluster Admin	Full access to everything	Platform engineers

2. Service Accounts and Pod Identities

Service accounts provide identity for pods.

Best Practices:

• Disable Default Service Account Auto-mounting:

  yaml

  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: default
  automountServiceAccountToken: false

• Create Dedicated Service Accounts:

  yaml

  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: my-app-sa

• Use Workload Identity:

  • AWS: IAM Roles for Service Accounts (IRSA)

  • GCP: Workload Identity

  • Azure: Workload Identity

3. Use OIDC for External Authentication

yaml

# OIDC configuration (kube-apiserver)
--oidc-issuer-url=https://accounts.google.com
--oidc-client-id=kubernetes
--oidc-username-claim=email
--oidc-groups-claim=groups

---

Part 2: Pod Security

1. Pod Security Standards

Kubernetes provides three built-in Pod Security Standards:

Standard	Description	Use Case
Privileged	No restrictions	System components, CI/CD runners
Baseline	Minimal restrictions, prevents known privilege escalations	General purpose applications
Restricted	Heavily restricted, follows hardening best practices	Highly sensitive workloads

Enforce with Pod Security Admission:

yaml

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/audit: restricted

2. SecurityContext

SecurityContext configures security settings at the pod or container level.

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

Key SecurityContext Settings:

Setting	Purpose
runAsNonRoot: true	Prevent running as root
runAsUser	Set non-root user ID
readOnlyRootFilesystem: true	Make root filesystem read-only
allowPrivilegeEscalation: false	Prevent gaining more privileges
capabilities.drop: ["ALL"]	Drop all Linux capabilities
seccompProfile.type: RuntimeDefault	Restrict system calls

3. Resource Limits

Set resource limits to prevent DoS attacks.

yaml

resources:
  requests:
    memory: "256Mi"
    cpu: "250m"
  limits:
    memory: "512Mi"
    cpu: "500m"

---

Part 3: Network Security

1. Network Policies

Network Policies control traffic flow between pods and endpoints. By default, pods can communicate freely. Use Network Policies to restrict this.

Default Deny All:

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Allow Only from Specific Namespace:

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-monitoring
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring
    ports:
    - protocol: TCP
      port: 9090

2. Service Mesh Security

Use a service mesh (Istio, Linkerd) for mTLS encryption between services.

mTLS Configuration (Istio):

yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

---

Part 4: Image Security

1. Use Minimal Base Images

Choose minimal base images to reduce attack surface.

Base Image	Size	Use Case
Distroless	Minimal	Production
Alpine	Very small	General purpose
Slim	Small	Balanced
Full	Large	Development

2. Scan Images for Vulnerabilities

Scan all container images before deployment.

Trivy:

bash

trivy image --severity HIGH,CRITICAL myapp:latest

GitHub Actions with Trivy:

yaml

- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'

3. Use Trusted Registries

• Use trusted image registries (Docker Hub official images, ECR, GCR)

• Enable registry authentication for private registries

• Use image signing (Cosign, Notary)

---

Part 5: Cluster Security

1. Upgrade Kubernetes Regularly

Keep your Kubernetes cluster updated with security patches.

bash

# Check available updates
kubectl get nodes -o wide
# Or use your cloud provider's update mechanism

2. Secure kube-apiserver

• Use TLS for all communication

• Enable audit logging

• Restrict access to the API server

• Use OIDC for external authentication

3. etcd Security

• Encrypt etcd data at rest

• Restrict access to etcd (only for kube-apiserver)

• Backup etcd regularly

4. Use Private Clusters

• Use private clusters (VPC only, no public endpoints)

• Use network policies to restrict access

• Use VPN or private connectivity for management

---

Security Checklist

Authentication & Authorization

• □

  RBAC enabled and properly configured

• □

  Service accounts have minimal permissions

• □

  OIDC or other authentication configured

• □

  Audit logs enabled

Pod Security

• □

  Pod Security Standards enforced

• □

  SecurityContext configured for all pods

• □

  Resource limits set

• □

  Non-root user enforced

Network Security

• □

  Network Policies implemented

• □

  Default deny all policy applied

• □

  Ingress/egress traffic restricted

• □

  Service mesh for mTLS (if applicable)

Image Security

• □

  Minimal base images used

• □

  Images scanned for vulnerabilities

• □

  Image signing enabled

• □

  Trusted registries used

Cluster Security

• □

  Kubernetes version up to date

• □

  etcd encrypted

• □

  Private cluster network configured

• □

  Regular security audits performed

Monitoring & Logging

• □

  Cluster monitoring enabled

• □

  Audit logging configured

• □

  Security alerts configured

• □

  Regular security reviews

---

Common Kubernetes Security Mistakes

Mistake	Risk	Mitigation
Running as root	Container can access host resources	Use runAsNonRoot: true
No resource limits	DoS attacks	Set CPU/memory limits
Public endpoints	Exposed to internet	Use private clusters or network policies
No network policies	Pods can communicate freely	Apply default deny policy
Using latest tag	Unpredictable versions	Use specific image tags
No image scanning	Vulnerable images deployed	Integrate scanning in CI/CD
Too permissive RBAC	Excessive permissions	Apply least privilege
No audit logging	No visibility into attacks	Enable audit logging

---

Summary

Layer	Key Controls
Authentication	RBAC, Service Accounts, OIDC
Pod Security	Pod Security Standards, SecurityContext
Network	Network Policies, Service Mesh
Images	Minimal images, Scanning, Signing
Cluster	Upgrades, etcd encryption, Private clusters
Monitoring	Audit logs, Monitoring, Alerts

---

Learn More

Practice Kubernetes security with hands-on exercises in our interactive labs:
https://devops.trainwithsky.com