Security (DevSecOps) · Module 07

Kubernetes security

Narrow what workloads can do in the cluster: securityContext, Pod Security Standards, NetworkPolicy to isolate traffic, Kyverno policies and runtime detection of unusual behaviour with Falco.

Practice interactively →

What you will learn

• Configure securityContext: runAsNonRoot, readOnlyRootFilesystem, dropped capabilities
• Apply Pod Security Standards levels to namespaces with labels
• Write default-deny NetworkPolicies and allow only the traffic needed
• Write Kyverno policies in Audit and Enforce modes
• Explain how Falco detects unusual runtime behaviour

Lessons

1. securityContext for Pods and containers

   By default a container may run as root with many Linux capabilities; securityContext forces a normal user, blocks privilege escalation, makes the filesystem read-only, drops capabilities and enables seccomp.

2. Pod Security Standards and Pod Security Admission

   Kubernetes defines three levels, Privileged, Baseline and Restricted; the built-in Pod Security Admission applies them per namespace through labels in enforce, audit or warn mode.

3. NetworkPolicy - isolating traffic between Pods

   By default every Pod can talk to every Pod; a NetworkPolicy selects Pods by label and allows specific ingress and egress, starting from default deny and remembering to allow DNS.

4. Kubernetes policy with Kyverno

   Kyverno is an admission controller whose policies are familiar YAML; validate blocks bad configuration, mutate adds defaults, generate creates companion resources and verifyImages requires signatures.

5. Runtime detection with Falco

   Everything so far is preventive; Falco watches container system calls through eBPF and alerts on unusual behaviour such as a shell inside a container, reading sensitive files or odd outbound connections.