Kubernetes Security

Authorization Boundary

• Require cluster context, namespace scope, and read-only kubeconfig before live queries.
• Avoid disruptive runtime probes on production; prefer staging or ephemeral clusters.

Hardening Workflow

1. Inventory: API server flags, node OS, CNI, CSI, ingress, service mesh, admission plugins, controllers.
2. Scan: kube-bench, kubescape, trivy k8s, polaris, kubeaudit, popeye.
3. RBAC: enumerate ClusterRole/RoleBinding; flag wildcard verbs, system:masters, escalate, bind, impersonate, secret reads from broad subjects.
4. Workloads: enforce Pod Security restricted, drop capabilities, read-only rootfs, non-root UID, seccomp RuntimeDefault, no hostPath/hostNetwork/hostPID.
5. Network: default-deny NetworkPolicy; explicit egress to known services; mTLS via mesh where applicable.
6. Supply chain: signed images (cosign verify), provenance attestations (SLSA), admission policy that blocks unsigned.
7. Runtime: Falco/Tetragon rules for exec-in-container, reverse shells, crypto miners, sensitive mounts.

Multi-Tenant Patterns