Kubernetes Security

Kubernetes ships permissive by default: any pod gets a service-account token mountable for API access, RBAC starts wide open until you constrain it, and nothing stops a container from running as root unless you tell it not to. Security here is subtractive work — removing default permissions the platform hands out for convenience, not adding a product on top.

Assume every pod will eventually be compromised and ask what that gets the attacker. The right default is the least the workload needs to function, enforced at admission, not caught in review.

1. Scope RBAC to the verb and resource, not the namespace

The most common RBAC mistake is binding ClusterRole: edit or cluster-admin because a narrower role was fiddly to write. A Role/ClusterRole should list exact verbs (get, list, watch, create) against exact resources — "can read Pods in this namespace" is a different, much smaller grant than "edit everything."