Kubernetes Security

This roadmap covers securing Kubernetes clusters and workloads: the control plane, RBAC, network policies, pod security, supply chain and runtime detection. You should know containers and have a local cluster (kind or minikube).

• Run a local cluster with kind or minikube
• Use kubectl comfortably
• Plan your study time

• CyberA4U Academy — courses

Kubernetes has a control plane (API server, etcd, scheduler, controllers) and worker nodes (kubelet, container runtime). Each component is a security boundary.

• Explain control-plane and node components
• Understand how requests flow through the API server
• Identify sensitive components

الأدوات والتقنيات: Kubernetes

• Kubernetes — Cluster architecture

The API server is the front door to the cluster. Authentication, authorization and admission control decide every request.

• Understand authentication methods
• Restrict network access to the API
• Audit API requests

الأدوات والتقنيات: Kubernetes

• Kubernetes — Controlling access to the API

Role-based access control grants permissions to users and service accounts. Over-broad roles such as cluster-admin are a major risk.

• Write Roles and RoleBindings
• Avoid wildcard permissions
• Review who can do what

الأدوات والتقنيات: Kubernetes

• Kubernetes — Using RBAC authorization

Namespaces separate teams and workloads, but they're not a hard security boundary on their own.

• Use namespaces with RBAC and quotas
• Understand multi-tenancy limits
• Choose soft vs hard isolation

الأدوات والتقنيات: Kubernetes

• Kubernetes — Multi-tenancy

By default all pods can talk to each other. Network policies restrict traffic to what each workload needs.

• Write default-deny policies
• Allow only required traffic
• Test policies

الأدوات والتقنيات: Kubernetes

• Kubernetes — Network policies

Kubernetes Secrets are only base64-encoded by default. Encrypt them at rest, limit access, and consider external secret stores.

• Enable encryption at rest
• Restrict access to secrets
• Use external secret managers where needed

الأدوات والتقنيات: Kubernetes

• Kubernetes — Good practices for Secrets

Pod Security Standards (privileged, baseline, restricted) prevent risky settings such as privileged containers and host access.

• Apply Pod Security Admission levels
• Run containers as non-root
• Block host namespaces and privileged mode

الأدوات والتقنيات: Kubernetes

• Kubernetes — Pod Security Standards

Admission controllers validate or modify objects before they're stored. Policy engines like Kyverno or OPA Gatekeeper enforce custom rules.

• Understand validating and mutating admission
• Enforce policies such as "images from trusted registry only"
• Test policies before enforcing

الأدوات والتقنيات: Kubernetes

• Kubernetes — Admission controllers reference

Only trusted, scanned and signed images should run in the cluster. SLSA and Sigstore help prove where images came from.

• Scan images before deployment
• Verify signatures at admission
• Use trusted registries

الأدوات والتقنيات: Kubernetes

• SLSA — Supply-chain Levels for Software Artifacts

Runtime detection spots suspicious behavior inside running pods — shells, unexpected network connections, privilege escalation.

• Deploy Falco or similar
• Tune rules for your workloads
• Route alerts to responders

الأدوات والتقنيات: Kubernetes

• Falco documentation

etcd stores all cluster state, including secrets. Protect it with TLS, encryption and strict network access.

• Secure etcd communication and access
• Harden control-plane components
• Back up etcd securely

الأدوات والتقنيات: Kubernetes

• Kubernetes — Securing a cluster

Common paths include exposed dashboards, over-privileged service accounts, privileged pods and leaked kubeconfigs. MITRE ATT&CK's containers matrix catalogs these techniques.

• Recognize common Kubernetes attack paths
• Map them to defensive controls
• Prioritize fixes

الأدوات والتقنيات: Kubernetes

تعلّمها على CyberA4U:Module 21: Cloud Environment Attack Techniques

• MITRE ATT&CK — Containers matrix

The CIS Kubernetes Benchmark lists hardening checks for control plane, nodes and policies. Tools such as kube-bench automate them.

• Run a benchmark scan
• Understand failed checks
• Fix or accept findings with reasons

الأدوات والتقنيات: Kubernetes

• CIS Kubernetes Benchmark

Responding in Kubernetes means isolating pods with network policies, preserving container state and logs, rotating credentials and redeploying from clean images.

• Isolate a compromised workload
• Collect pod, node and audit evidence
• Rotate service account tokens and secrets

الأدوات والتقنيات: Kubernetes

• Kubernetes — Auditing

Check that you can secure a Kubernetes cluster and its workloads, and respond when something goes wrong.

• Apply RBAC, network policies and pod security
• Secure the supply chain
• Detect and respond at runtime

• CyberA4U CTF Arena — practice challenges

You can now secure Kubernetes. Continue with Cloud Detection & Response or DevSecOps Pipeline, or a certification such as CKS.

• Keep your lab cluster
• Choose your next roadmap
• Share your hardening notes

• CyberA4U CTF Arena — practice challenges