Kubernetes Security Posture

• K8s is the most common runtime target today: one RBAC mistake or mislabeled namespace can grant cross-tenant admin.
• The control plane is a super-user rich in every app's data — protecting it is protecting everything it orchestrates.
• Admission and network policy are the 'SG + segmentation' of Kubernetes; absent them, pods are flat-trust.

The tower (API/etcd) concentrates authority; granting it to every scheduling request is how runways get mixed up.

• RBAC binds roles (permissions on API resources) to subjects; default is deny for unbound identities.
• Admission controllers (PSA or webhooks) force policy at write-time: non-root, no privileged, image provenance.
• Network policies are per-namespace default-deny: only allowed pod-to-pod flows exist.
• Secrets are base64 in etcd until encrypted at rest — encryption-at-rest on etcd is non-negotiable at scale.

• A fintech enforces 'no privileged containers, no hostNet, environments pinned' via an admission webhook at the API layer.
• A retail platform sets default-deny network policies then allows only the dashboard->api->db chain.
• An enterprise encrypts etcd at rest and rotates service-account tokens on a rotation cycle.

• Lock down the API server: HTTPS only, strong authn, minimal anonymous access, and admit policy in the door.
• Prefer namespace-wide default-deny network policies; review the allow-list before relaxing.
• Never store secrets in plaintext env vars — use the Secrets API with etcd encryption and RBAC read gates.
• Run pod security admission (or equivalent) at warn/audit first, then enforce.

• Cluster-admin for 'convenience' on a service account a compromised pod can inherit.
• A default 'allow all' network policy that means every pod reaches the control plane port.
• Secrets in the image's env or in the manifest repo — base64 is not encryption.
• Patching the app but never auditing the RBAC bindings that grant the blast radius.

• When a pod can't be scheduled, check admission policy errors in the events, not the image build.
• Use kubectl auth can-i to test a subject's exact permission — faster than reading solitaire role YAML.
• For network-policy silence, exec a ping/nc from one pod to another and read the CNPI logs.

• The cluster's audit log is evidence: enable it, ship it immutably, and alert on escalated permissions.
• Treat service accounts like machine identities: automated rotation, lifecycle check, and least scope.