Container Security

RBAC Design Principles

• Never bind cluster-admin to application service accounts
• Use namespace-scoped Roles rather than ClusterRoles where possible
• Create dedicated service accounts per workload (never use default SA)
• Disable service account token auto-mounting for pods that don't need it
• Audit RBAC with tools: kubectl-who-can, rakkess, rbac-lookup
• Use kubectl auth can-i --list to review effective permissions

Pod Security Standards

Pod Security Standards (PSS) replaced PodSecurityPolicy in Kubernetes 1.25. They define three profiles enforced by a built-in admission controller.

• Privileged: unrestricted — only for system components
• Baseline: prevents known privilege escalations; reasonable for most workloads
• Restricted: hardened; requires runAsNonRoot, drops all capabilities, enforces seccomp
• Apply via namespace labels: pod-security.kubernetes.io/enforce: restricted
• OPA/Gatekeeper and Kyverno extend PSS with custom policy logic

Cloud Registry Security

• AWS ECR: Enhanced Scanning via Inspector v2 (Snyk-powered); scan on push; OS + language packages
• Azure ACR: Microsoft Defender for Containers; scans both on push and continuously for new CVEs
• GCP Artifact Registry: Artifact Analysis (On-Demand Scanning); continuous scanning with new CVE database updates
• Enable scan-on-push policies — block deployments if critical CVEs present
• Enforce tag immutability — prevent tag reassignment that can slip bad images through

Image Signing & Supply Chain

• Sigstore/Cosign: open standard for keyless image signing using OIDC identity; growing adoption
• Notary v2: CNCF standard for signing OCI artifacts; used by AWS Signer integration
• SLSA framework: supply chain levels for software artifacts — provenance attestation
• SBOM (Software Bill of Materials): generate and attest SBOMs in CI; Syft + Grype
• Scan third-party base images before using; prefer distroless or scratch-based images
• Dependency pinning: pin base image digests in Dockerfiles, not floating tags

NetworkPolicy Best Practices

• Start with a default-deny-all policy in every namespace
• Allow traffic only on required ports between specific pod selectors
• Separate ingress and egress policies; don't forget DNS (UDP/TCP 53 to CoreDNS)
• Use Cilium or Calico for NetworkPolicy enforcement (CNI must support it)
• Cilium: eBPF-based; supports L7 HTTP/gRPC policy rules beyond IP/port
• Test policies with kubectl-netpol or Inspektor Gadget

Service Mesh Security (Istio)

A service mesh provides automatic mutual TLS (mTLS) between all microservices, eliminating the need for applications to implement transport security themselves.

• mTLS: both sides present certificates — prevents impersonation between services
• PeerAuthentication: enforce STRICT mTLS in a namespace
• AuthorizationPolicy: allow only specific service accounts to call specific methods
• Envoy sidecar handles all traffic — transparent to application code
• Ambient mode (Istio 1.18+): eBPF-based, no sidecar injection needed

Cloud-Specific CNI Features

• AWS VPC CNI: security groups for pods — apply EC2 security groups directly to individual pods
• AKS Azure CNI: pods get VNet IPs; Azure NSGs apply to pod traffic natively
• GKE Dataplane V2: eBPF-based with built-in NetworkPolicy enforcement via Cilium
• Private cluster API servers: no public endpoint for the Kubernetes API
• Use Private Service Connect / PrivateLink for Ingress without public IPs

Secrets Management

• Enable etcd encryption at rest using the Kubernetes EncryptionConfiguration API
• External Secrets Operator (ESO): syncs from Vault, AWS SSM/Secrets Manager, Azure Key Vault, GCP Secret Manager into K8s Secrets
• Secrets Store CSI Driver: mount secrets from external vaults as files without creating K8s Secret objects
• Avoid storing secrets in ConfigMaps, environment variables, or Docker images
• Rotate secrets automatically; ESO handles sync on rotation

Falco Runtime Security

Falco is the de facto standard for Kubernetes runtime threat detection. It uses eBPF or kernel module to observe system calls and generates alerts when container behavior deviates from expected patterns.

• Detects: shell spawned in container, write to /etc, network tool execution
• Container drift: execution of a binary not present in the original image
• Privilege escalation attempts, sensitive file reads, outbound C2 connections
• Falcosidekick: route alerts to Slack, PagerDuty, SIEM, S3
• Talon (Falco response engine): auto-kill offending pods on rule match

Cloud-Native Runtime Detection

• GuardDuty for EKS: analyzes EKS audit logs and runtime activity for K8s-specific threats
• Microsoft Defender for Containers: integrates with AKS for runtime threat detection + image scanning
• GCP Container Threat Detection: eBPF-based; detects added binary executed, reverse shell, cryptocurrency mining
• These managed services require no Falco deployment — useful as baseline or complement

etcd Encryption Configuration

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
      - configmaps
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key>
      - identity: {}