Kubernetes Security Best Practices: Securing Container Orchestration

Introduction to Kubernetes Security

Kubernetes has become the de facto standard for container orchestration, running critical workloads across industries. However, its complexity and power also introduce significant security challenges. Misconfigured Kubernetes clusters are a leading cause of cloud security incidents.

The 4C's of Cloud Native Security

Kubernetes security follows a layered approach:

1. Cloud Security

2. Cluster Security

3. Container Security

4. Code Security

Cluster Hardening

API Server Security

The API server is the control plane gateway—secure it rigorously.

# Disable anonymous authentication
--anonymous-auth=false
# Enable OIDC authentication
--oidc-issuer-url=https://your-idp.com
--oidc-client-id=kubernetes
--oidc-username-claim=email
--oidc-groups-claim=groups

# Use RBAC
--authorization-mode=RBAC,Node
# Enable admission controllers
--enable-admission-plugins=NodeRestriction,PodSecurityPolicy

# Enable audit logging
--audit-log-path=/var/log/kubernetes/audit.log
--audit-log-maxage=30
--audit-log-maxbackup=10
--audit-policy-file=/etc/kubernetes/audit-policy.yaml

Etcd Security

Etcd stores all cluster state—it must be heavily protected.

# TLS configuration
--cert-file=/path/to/server.crt
--key-file=/path/to/server.key
--trusted-ca-file=/path/to/ca.crt
--client-cert-auth=true
--peer-cert-file=/path/to/peer.crt
--peer-key-file=/path/to/peer.key
--peer-client-cert-auth=true

Kubelet Security

# kubelet configuration
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
authorization:
  mode: Webhook
readOnlyPort: 0  # Disable read-only port
protectKernelDefaults: true

RBAC Best Practices

Principle of Least Privilege

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: User
  name: [email protected]
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list"]
  # NO create, delete, or update

RBAC Audit

Regularly audit RBAC:

# List all cluster-admin bindings
kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'
# Find pods with service account tokens
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.automountServiceAccountToken != false) | .metadata.name'

Pod Security

Pod Security Standards

Kubernetes provides three security profiles:

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Security Context

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
          - ALL
    resources:
      limits:
        cpu: "500m"
        memory: "128Mi"
      requests:
        cpu: "100m"
        memory: "64Mi"

Key Security Settings

Network Policies

Default Deny

Start with default deny and explicitly allow required traffic.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Network Segmentation

Secrets Management

Kubernetes Secrets Limitations

Native K8s secrets are only base64 encoded—not encrypted by default.

# EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-key>
      - identity: {}

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: app-secret
spec:
  vaultAuthRef: vault-auth
  mount: secret
  path: app/config
  destination:
    name: app-secret
    create: true

Secrets Best Practices

Image Security

Container Image Best Practices

# Good: Distroless images
FROM gcr.io/distroless/static:nonroot
# Good: Alpine for minimal footprint
FROM alpine:3.18
# Avoid: Full OS images
# FROM ubuntu:22.04

# Trivy scanning
trivy image myapp:1.0
# Grype scanning
grype myapp:1.0

# Sign with cosign
cosign sign --key cosign.key myregistry/myapp:1.0
# Verify signature
cosign verify --key cosign.pub myregistry/myapp:1.0

Admission Control

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: image-policy
webhooks:
- name: image-policy.example.com
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    operations: ["CREATE", "UPDATE"]
    resources: ["pods"]

Runtime Security

Container Runtime Protection

- rule: Terminal shell in container
  desc: A shell was spawned in a container
  condition: >
    spawned_process and container and
    shell_procs and proc.tty != 0
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
    shell=%proc.name)
  priority: WARNING
  tags: [container, shell]

Syscall Filtering with Seccomp

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault  # Or custom profile
  containers:
  - name: app
    image: myapp:1.0

Monitoring and Auditing

Essential Logs

Security Monitoring

Security Checklist

Cluster Level

Workload Level

Image Level

Operational

Conclusion

Kubernetes security requires a comprehensive, layered approach. From cluster hardening to pod security to runtime protection, each layer contributes to the overall security posture. Start with the basics—RBAC, network policies, and pod security—then build toward more advanced controls.

Asfaleia-Tech offers Kubernetes security assessments, implementation support, and ongoing monitoring. Contact us to secure your container infrastructure.