Kubernetes Security
Securing a container orchestration platform across several distinct layers: the control plane and API server, cluster authorisation via RBAC, workload constraints through Pod Security Standards and admission control, network isolation with NetworkPolicies, secrets handling, and image provenance. Kubernetes ships permissive by default -- all pods can reach all pods, and nothing restricts a privileged container unless a policy says so. It is examined in CKS, CCSP, AZ-500 and cloud-security curricula.
Why It Matters
In practice the most important thing to understand is that a namespace is an organising boundary, not a security boundary strong enough for hostile multi-tenancy on its own, because tenants share a kernel per node and a container escape is indifferent to Kubernetes API constructs. That is why genuinely untrusted workloads get stronger runtime isolation, dedicated node pools or separate clusters rather than more RBAC. Recurring real findings are default-allow networking with no NetworkPolicy, over-broad cluster roles bound to service accounts, secrets mounted as environment variables where any crash dump or process listing exposes them, pods running as root with host mounts, and images pulled by mutable tags with no signature check. Enforcement should be admission-time rather than convention: a policy engine that rejects a non-compliant pod is a control, while a documented standard is a hope. On exams such as CKS and CCSP, expect questions on RBAC scoping, Pod Security Standards levels, and why namespace isolation is insufficient for untrusted tenants.
Practice this topic
Test your knowledge of Kubernetes Security concepts with exam-style practice questions.
Related Cloud Security terms
Cloud Security
The set of policies, technologies, controls, and services deployed to protect data, applications, and infrastructure in cloud computing environments (IaaS, PaaS, SaaS). Cloud security challenges include shared responsibility models, multi-tenancy risks, data sovereignty, identity federation, and misconfiguration (the leading cause of cloud breaches). Key controls include encryption at rest and in transit, identity and access management, network segmentation, logging/monitoring, and Cloud Security Posture Management (CSPM) tools. Major providers (AWS, Azure, GCP) offer native security services but customers remain responsible for their configuration. Cloud security is the focus of CCSP, AWS Security Specialty, AZ-500, and is increasingly prominent in CISSP exams.
Shared Responsibility Model
A framework that defines and delineates security obligations between cloud service providers (CSPs) and their customers, varying by service model. In IaaS, the provider secures the physical infrastructure while the customer secures the OS, applications, and data. In PaaS, the provider additionally manages the OS and runtime. In SaaS, the provider handles almost everything except user access management and data classification. Misunderstanding the shared responsibility model is a leading cause of cloud security breaches. This concept is essential knowledge for CCSP, AWS Security Specialty, AZ-500, and CISSP cloud security domains.
CASB (Cloud Access Security Broker)
A security policy enforcement point placed between cloud service consumers and cloud service providers to monitor activity, enforce security policies, and provide visibility into cloud usage. CASBs offer four pillars of functionality: visibility (shadow IT discovery), compliance (data residency, regulatory requirements), data security (DLP, encryption), and threat protection (anomaly detection, malware prevention). Deployment modes include API-based, proxy-based (forward/reverse), and log collection. Leading CASB vendors include Microsoft Defender for Cloud Apps, Netskope, Zscaler, and Palo Alto Prisma. CASBs are covered in CCSP, CISSP, and cloud security certifications.
Container Security
The process of implementing security tools, policies, and best practices to ensure that containerized applications (Docker, Kubernetes) run safely without introducing vulnerabilities. Key concerns include image security (scanning for vulnerabilities in base images), runtime security (preventing container escape and privilege escalation), secrets management, network policies between containers, and supply chain security for container registries. Tools include Trivy, Aqua Security, Falco, and Snyk Container. Container security is increasingly important as organizations adopt microservices architectures and is tested in DevSecOps, CCSP, and cloud security certifications.
IAM (Identity and Access Management)
A framework of policies, processes, and technologies for managing digital identities and controlling user access to critical information and resources within an organization. IAM encompasses user provisioning, authentication, authorization, identity governance, privileged access management (PAM), and identity lifecycle management. Cloud IAM services (AWS IAM, Azure AD, Google Cloud IAM) enable fine-grained permission policies using roles, groups, and policies. Centralized IAM reduces the attack surface and simplifies compliance with regulations like SOX, HIPAA, and GDPR. IAM is a core topic in CISSP Domain 5, CCSP, and cloud security certifications.
Identity and Access Management (IAM)
A framework of policies and technologies that ensures the right individuals have appropriate access to resources at the right times for the right reasons. IAM encompasses user identity verification, access provisioning, authentication, authorization, and access governance. Cloud IAM services like AWS IAM, Azure AD, and Google Cloud Identity provide centralized identity management across cloud resources. Key components include users, groups, roles, policies, and permissions. IAM is fundamental to cloud security and is heavily tested in CCSP, AWS certifications, and Security+ exams.