CCHQ ARTICLE GUIDE / CONTAINERS & KUBERNETES
Practical learning, clear decisions, real-world context
An easy-to-navigate field guide with key takeaways, applied checks, FAQs, and official references. Approximately 7 minutes of reading.
Kubernetes security basics require more than checking whether a cluster is private.
Cluster administrators must control access to the Kubernetes API, restrict communication between workloads, protect secrets, harden Pods, secure images, and observe unexpected changes.
Kubernetes Role-Based Access Control (RBAC), NetworkPolicies, and Secret objects address different security questions; none replaces the others.
A Pod may have very narrow RBAC rights and still expose an unauthenticated HTTP endpoint, while a network policy cannot stop an authorized user from modifying a Deployment.
This guide gives cloud engineers a layered approach to Kubernetes security with practical review examples, common failure modes, and validation techniques.
Work only in clusters you administer or are authorized to test, and verify the behavior of your distribution and network plugin before relying on a policy.
At a glance
The main topics you’ll work through:
- Start with the assets and trust boundaries
- RBAC: who can call the Kubernetes API?
- Service accounts and workload identity
- NetworkPolicies: limit workload connectivity
In this guide
01 / KEY CONCEPT
Start with the assets and trust boundaries
KEY TAKEAWAY
Map the cluster control plane, worker nodes, application namespaces, service accounts, ingress points, registries, and cloud-provider integrations.
Identify which components need to make Kubernetes API calls and which only serve application traffic. Separate the permissions of human operators, deployment automation, controllers, and applications.
A public web service, for example, may need to accept HTTPS requests without any permission to create Kubernetes workloads or read cluster secrets.
Build a data-flow diagram showing who deploys images, where credentials enter, and which services handle sensitive data. Mark boundaries between namespaces and between the cluster and external AWS APIs.
Cluster namespaces help organize and scope resources, but they are not a complete security boundary on their own. Shared nodes, network defaults, and powerful cluster-level permissions can cut across namespace expectations.
Choose controls based on the actual threat model, not the label placed on a namespace.
02 / PRACTICAL APPLICATION
RBAC: who can call the Kubernetes API?
KEY TAKEAWAY
Kubernetes RBAC uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects to grant API permissions.
A Role is namespaced, while a ClusterRole is not; bindings determine where permissions apply. Rules are additive and specify verbs, API groups, and resources. A RoleBinding can bind a ClusterRole’s permissions inside a namespace, so the combination matters.
Avoid granting cluster-admin to routine workloads or every developer just to bypass permission errors.
For an application that only needs to read one ConfigMap, consider whether it needs API access at all. If it does, bind a narrowly scoped role to an application-specific ServiceAccount.
Review permissions for verbs such as create, update, patch, delete, impersonate, and access to secrets; these can have greater impact than ordinary get/list operations.
The command kubectl auth can-i can help assess effective permission in an authorized context, though impersonation tests may require additional privileges. Document expected allowed and denied actions, then verify them.
03 / KEY CONCEPT
Service accounts and workload identity
KEY TAKEAWAY
A Kubernetes ServiceAccount identifies a workload to the cluster.
It is distinct from a human identity and from an AWS IAM role, although managed cluster integrations may connect these systems. Prefer one ServiceAccount per application responsibility when API access is required.
Review whether service-account tokens are mounted automatically and whether an application actually needs them. An unnecessary mounted token can give compromised code an additional path into the cluster API.
Cloud API access should be scoped separately from Kubernetes API access. For a workload reading one S3 prefix, choose the supported AWS workload identity mechanism and grant the minimum required permissions.
Do not embed long-lived cloud keys in environment variables or container images. The identity model depends on the chosen Kubernetes distribution and integration, so validate the official provider guidance.
Audit who can modify ServiceAccounts, their role bindings, and the workloads that use them.
04 / PRACTICAL APPLICATION
NetworkPolicies: limit workload connectivity
KEY TAKEAWAY
NetworkPolicies describe allowed traffic for selected Pods in supported implementations.
They can help prevent unnecessary east-west communication and restrict access to data services. However, policy enforcement depends on the networking implementation; creating a valid object is not proof that traffic is being filtered.
Policy behavior is additive, and the standard model does not provide a general explicit-deny rule for every scenario. Review ingress and egress separately.
A useful initial pattern is to select a sensitive service, establish a default-deny posture for relevant traffic, and allow only the application Pods and ports that legitimately need it.
Be careful: DNS, metrics, service discovery, and control-plane dependencies can break if an egress policy is too restrictive. Test legitimate traffic and unauthorized traffic using temporary diagnostic workloads, not assumptions.
Record which CNI enforces policy and what happens while Pods are starting or policies are converging. Application authentication remains necessary even when network isolation works as intended.
05 / KEY CONCEPT
Secrets are not automatically a vault
KEY TAKEAWAY
Kubernetes Secrets provide an API mechanism for storing and distributing sensitive configuration, but ordinary base64 encoding in manifests is not encryption.
Cluster operators should review encryption at rest for Secret data, API permissions, audit logging, and whether workloads can read secrets belonging to other applications.
Do not commit decoded secret values or Secret manifests containing real values to public repositories. Avoid printing credentials into Pod descriptions, debugging logs, or troubleshooting transcripts.
For cloud deployments, consider an external secret manager and an approved integration that limits which workload identities can retrieve which values. Understand the sync mechanism and what happens during rotation or revocation.
Some integrations materialize values into Kubernetes Secrets, so the cluster’s Secret protections still matter. Document the secret’s owner, rotation process, allowed consumers, and emergency replacement plan.
A Secret that never rotates and is readable by a broad cluster role represents risk even if it is stored under a secure-looking resource name.
06 / PRACTICAL APPLICATION
Pod security and runtime hardening
KEY TAKEAWAY
Containers run with a set of operating-system capabilities and filesystem privileges.
Reduce privileges where possible: avoid privileged mode, run as a non-root identity when supported, drop unnecessary capabilities, use read-only filesystems where practical, and limit host namespace or hostPath access.
Pod Security Standards provide a policy vocabulary, including restricted behavior for applicable workloads, but compatibility must be assessed for legitimate agents and specialized infrastructure components.
Enforce safeguards through admission controls or platform policy where supported, and test rollouts before activating strict restrictions across all namespaces. A restrictive configuration that breaks required monitoring agents can create blind spots.
Scan image dependencies and keep runtimes, node images, and cluster components patched according to their responsibility model. Use resource requests and limits to reduce resource contention, while recognizing that quotas do not replace authorization.
Review ephemeral containers and debugging privileges because administrative troubleshooting paths can bypass assumptions about normal application behavior.
07 / KEY CONCEPT
Image supply chain and deployment security
KEY TAKEAWAY
A secure cluster can still execute compromised application code if an attacker controls the image registry or deployment pipeline.
Use reviewed source code, controlled builds, dependency scanning, immutable image references when feasible, and clear promotion between environments. Restrict who may push release images and who may change Deployment or admission configuration.
Do not assume that a green vulnerability scan proves an image is trustworthy; it detects only certain known weaknesses and does not validate application logic.
For sensitive workloads, consider signed artifacts, provenance records, and admission checks backed by organizational policy. Protect CI/CD credentials with federation and narrow cloud roles. Audit third-party actions and chart or manifest dependencies.
If a released image becomes suspect, you need a repeatable way to identify affected deployments, replace the artifact, and examine relevant logs.
Design for investigation before incident response depends on it, and keep a tested rollback path that handles database compatibility and irreversible changes.
08 / PRACTICAL APPLICATION
Observability, auditing, and incident drills
KEY TAKEAWAY
Collect relevant Kubernetes audit events, application logs, and node or container runtime signals through an appropriate monitoring architecture.
Decide which activities warrant alerts, such as changes to cluster role bindings, admission rules, sensitive Secrets, or publicly exposed services. Retain enough context to investigate an event without collecting excessive personal data or credentials.
Restrict access to audit logs and document which team will respond to alerts.
In a nonproduction cluster, test that a restricted ServiceAccount cannot list Secrets it does not own and that a denied network path actually fails. Observe corresponding API and network evidence where the implementation provides it.
Check the effect of a Pod restart, node disruption, and invalid image reference on application health. After a security drill, improve one control or runbook based on the actual result.
Kubernetes security is an operational process involving configuration, evidence, and recovery—not an installation stage completed once.
Before you finish: practical checklist
Turn the main lessons into a short review of your own environment:
- Map the cluster control plane, worker nodes, application namespaces, service accounts, ingress points, registries, and cloud-provider integrations.
- Identify which components need to make Kubernetes API calls and which only serve application traffic.
- Build a data-flow diagram showing who deploys images, where credentials enter, and which services handle sensitive data.
- Choose controls based on the actual threat model, not the label placed on a namespace.
- Avoid granting cluster-admin to routine workloads or every developer just to bypass permission errors.
Command quick reference
Use these commands only in an appropriate, authorized environment, after checking prerequisites.
kubectl auth can-iFrequently asked questions
Does RBAC control network traffic?
No. RBAC controls Kubernetes API authorization. NetworkPolicies concern Pod connectivity when supported by the network implementation.
Are namespaces security boundaries?
They provide scope and organization, but shared cluster components and powerful permissions can cross them. Additional controls and sometimes separate clusters may be required.
Can a Kubernetes Secret be placed safely in Git?
Do not commit plaintext or merely base64-encoded secret values. Use approved encrypted or external secret-management workflows and protect decryption keys.
Official references and next steps
Kubernetes RBAC documentation · Kubernetes NetworkPolicies · Kubernetes security concepts
Begin by documenting one application’s API rights, network paths, secret access, and expected failure behavior. Then prove both allowed and denied operations in a disposable environment.
Explore Containers & Kubernetes for orchestration fundamentals and platform choices.
