Skip to main content
Mapagam

Implementing Security Best Practices

1. Implementing Network Segmentation

Feature Description Configuration
NetworkPolicy Controls traffic flow between pods and services 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: example-policy
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database

Example: Network Policy for Frontend to Database

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-db-policy
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 5432

2. Enabling RBAC Authorization

Resource Permission Usage
Role Define permissions within a namespace 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
RoleBinding Bind Role to users/groups 
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Example: Role for Pod Access

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: production
  name: pod-manager
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]

3. Using Pod Security Standards

Standard Description Enforcement
Privileged Allows any privilege escalation 
podSecurity: 
  enforce: privileged
Baseline Minimum security requirements 
podSecurity: 
  enforce: baseline
Restricted Strictest security settings 
podSecurity: 
  enforce: restricted

Example: Enforce Restricted Standard

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  annotations:
    pod-security.kubernetes.io/enforce: restricted

4. Scanning Container Images

Tool Functionality Integration
Trivy Open source vulnerability scanner trivy image --scanners vuln node:18-alpine
Clair Static analysis for vulnerabilities clairctl scan image-name
Aqua Security Advanced image scanning with policy enforcement aqua scan image-name --policy policy.yaml

Example: Trivy Scan Output

trivy image --scanners vuln node:18-alpine
...
Vulnerabilities:
  CVE-2023-12345
    Severity: HIGH
    Description: Memory leak in libcurl
    Fix Version: 7.85.0

5. Enabling Secrets Encryption

Feature Description Configuration
Encryption Provider Encrypts secrets at rest 
encryption:
  providers:
    - aescbc:
        keys:
          - name: key1
            secret: <base64-encoded-key>
KMS Provider Uses KMS for encryption keys 
encryption:
  providers:
    - kms:
        name: my-kms-provider
        endpoint: https://kms.example.com

Example: Secrets Encryption Config

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-key>

6. Using Admission Controllers

Controller Description Enabled By Default
PodSecurity Enforces Pod Security Standards NEW in v1.25
NamespaceLifecycle Prevents deletion of critical namespaces Yes
ResourceQuota Enforces resource limits per namespace Yes

Example: Admission Controller Configuration

apiVersion: v1
kind: ConfigMap
metadata:
  name: admission-config
data:
  config.yaml: |
    apiVersion: apiserver.config.k8s.io/v1
    kind: AdmissionConfiguration
    plugins:
      - name: PodSecurity
        configuration:
          apiVersion: pod-security.admission.config.k8s.io/v1beta1
          kind: PodSecurityConfiguration
          defaults:
            enforce: restricted

7. Enabling Audit Logging

Level Description Use Case
Metadata Log request metadata only Compliance reporting
Request Log request metadata and body Security incident analysis
RequestResponse Log request and response bodies Full audit trail

Example: Audit Log Configuration

apiVersion: v1
kind: ConfigMap
metadata:
  name: audit-config
data:
  policy.yaml: |
    apiVersion: audit.k8s.io/v1
    kind: Policy
    rules:
      - level: RequestResponse
        users: ["admin"]
        resources:
          - group: ""
            resources: ["secrets"]

8. Implementing mTLS

Component Description Implementation
Istio mTLS Enables mutual TLS between services 
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT
Service Mesh Secure communication between services istioctl install --set profile=ambient

Example: mTLS Configuration in Istio

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT
  selector:
    matchLabels:
      app: frontend

9. Rotating Certificates

Certificate Rotation Method Duration
CA Certificate Manual renewal or auto rotation 10 years
Client Certificates Renewal via kubeadm or manual process 1 year
Server Certificates Renewal via kubeadm or manual process 1 year

Example: Renewing Certificates

kubeadm alpha certs renew all

10. Running CIS Benchmarks

Benchmark Description Version
CIS Kubernetes Benchmark Security configuration guidelines v1.25
NIST SP 800-53 Security and privacy controls v5.1
MITRE ATT&CK Threat modeling for Kubernetes v1.0

Example: CIS Benchmark Scan

./cis-benchmark.sh --benchmark kubernetes-v1.25 --target /etc/kubernetes

11. Using Runtime Security

Tool Functionality Deployment
Falco Runtime security monitoring kubectl apply -f falco.yaml
Sysdig Secure Runtime policy enforcement and threat detection helm install sysdig-agent sysdig/agent

Example: Falco Rule for Suspicious Activity

apiVersion: falco.org/v1
kind: FalcoRule
metadata:
  name: suspicious-docker-exec
spec:
  condition: evt.type = execve and proc.name = docker
  output: "Suspicious Docker exec detected"
  priority: high

12. Implementing Supply Chain Security

Aspect Description Tools
Image Provenance Tracks image origin and integrity cosign verify --certificate-identity https://gcr.io/my-project/my-image
Dependency Scanning Scans for vulnerable dependencies trivy image --scanners vuln node:18-alpine
Policy Enforcement Enforces security policies at build time policy-bot check image-name --policy policy.yaml

Example: Supply Chain Policy Enforcement

apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: enforce-image-policy
spec:
  imagePatterns:
    - glob: "gcr.io/my-project/*"
  authorities:
    - name: my-key
      key:
        kms: "gcpkms://projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key"

Was this article helpful?

Related Cheat Sheets